CVE-2026-81028 Overview
CVE-2026-81028 is a path traversal vulnerability in ZLMediaKit that allows an authenticated caller to read files outside the configured root directories through the downloadFile API. The confinement check in server/WebApi.cpp uses a prefix comparison that ignores directory boundaries. A sibling directory whose name merely begins with a configured root string satisfies the check and is served. The endpoint requires the configured API secret, so the flaw grants no additional privilege, but it breaks the operator's intended file confinement. The reference container runs the server as root, which amplifies the impact of the exposure.
Critical Impact
Authenticated callers can read files outside configured root directories, and the reference container runs as root, exposing sensitive system files.
Affected Products
- ZLMediaKit media server
- Deployments using the downloadFile HTTP API with configured root directories
- Reference Docker container images running ZLMediaKit as root
Discovery Timeline
- 2026-08-26 - CVE-2026-81028 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-81028
Vulnerability Analysis
ZLMediaKit exposes a downloadFile HTTP API that is intended to serve files only from an operator-configured list of root directories. The configuration loader in server/WebApi.cpp builds each root using File::absolutePath("", item, true). Because the relative-path argument is empty, the helper returns the value without a trailing directory separator. The request handler then accepts a requested path when start_with(file_path, root) returns true.
The prefix comparison does not enforce a boundary between the root and the next path component. A directory named /srv/media_backup will satisfy a start_with check against a configured root of /srv/media. The only additional filter rejects paths containing .., which is not required to exploit this issue. The equivalent check in src/Http/HttpFileManager.cpp for the ordinary static file server passes a non-empty second argument to File::absolutePath, which appends the separator before comparison, and is therefore not vulnerable.
Root Cause
The root cause is an incorrect prefix comparison [CWE-22] that treats a root path as a string prefix rather than a directory. The missing trailing separator causes the confinement logic to accept sibling directories whose names share a prefix with a configured root. This is a classic directory-boundary error in path canonicalization.
Attack Vector
An attacker who possesses the configured API secret sends a downloadFile request specifying a target path that begins with the string of a configured root but resolves to a sibling directory. The handler passes the start_with check and returns file contents. When ZLMediaKit runs as root, as in the reference container, the reachable files include host filesystem paths mounted into the container. Exploitation requires only network access to the API endpoint and knowledge of the API secret. For technical details, see the VulnCheck Security Advisory and the GitHub Issue #4817.
Detection Methods for CVE-2026-81028
Indicators of Compromise
- HTTP requests to the downloadFile API endpoint with path parameters that resolve outside operator-intended directories.
- Access log entries showing successful downloads from directories whose names share a prefix with configured roots but are not the configured roots themselves.
- Unexpected reads of sensitive system files (for example, /etc/passwd, container secrets, key material) returned by the ZLMediaKit process.
Detection Strategies
- Compare requested downloadFile paths against the exact configured root directories, treating each root as a directory boundary and not a string prefix.
- Alert on any downloadFile request that resolves to a filesystem path outside the operator-defined allow list.
- Baseline the set of directories legitimately served by the API and flag deviations, especially reads from sibling directories.
Monitoring Recommendations
- Enable verbose HTTP access logging on the ZLMediaKit server and forward logs to a central SIEM or data lake for retention and analysis.
- Monitor filesystem read events from the ZLMediaKit process, particularly outside declared media directories, using host-based telemetry or eBPF.
- Track use of the API secret from unexpected source addresses or at unusual times to identify credential misuse.
How to Mitigate CVE-2026-81028
Immediate Actions Required
- Rotate the ZLMediaKit API secret and restrict network access to the management API to trusted operators only.
- Audit the configured downloadFile root directories and ensure no sibling directory on the same parent shares a name prefix with any configured root.
- Stop running the ZLMediaKit container as root. Use a dedicated non-privileged user and drop unnecessary Linux capabilities.
Patch Information
At the time of publication, a fixed release was not identified in the provided data. Consult the ZLMediaKit GitHub repository and Issue #4817 for upstream fix status. The corrected pattern used in src/Http/HttpFileManager.cpp demonstrates the intended behavior: pass a non-empty second argument to File::absolutePath so the returned root carries a trailing separator before the prefix comparison.
Workarounds
- Rename configured root directories or their siblings so that no configured root string is a prefix of any other directory on the same parent.
- Place each configured downloadFile root under a dedicated parent directory that contains no siblings, eliminating prefix collisions.
- Restrict access to the ZLMediaKit API behind a reverse proxy that validates request paths and enforces its own directory allow list.
- Run the server process as an unprivileged user with a filesystem view limited to media assets, using bind mounts or a chroot.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
