CVE-2026-92164: Streamlink Path Traversal Vulnerability

CVE-2026-92164 Overview

Streamlink is a command-line utility that pipes video streams from various online services into a local video player. Versions prior to 8.6.0 contain a flaw in the HTTPSession component that allows a remote server to trigger local file disclosure through a cross-protocol HTTP redirect. The HTTPSession mounts a FileAdapter for the file:// scheme and inherits redirect handling from requests.Session without rejecting cross-protocol redirects. An attacker who controls an HTTP or HTTPS URL fetched by Streamlink can return a redirect to a local file:// URL, causing Streamlink to read the file and return its contents to the response consumer. The issue is fixed in Streamlink 8.6.0. [CWE-73: External Control of File Name or Path]

Critical Impact
A malicious remote streaming endpoint can read arbitrary files from the user running Streamlink and inject that content into stream output through segment fetches.

Affected Products

Streamlink CLI utility versions prior to 8.6.0
Any Python application embedding Streamlink's HTTPSession class
HLS and DASH stream handlers relying on HTTPSession for manifest and segment fetches

Discovery Timeline

2026-09-23 - CVE-2026-92164 published to the National Vulnerability Database
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-92164

Vulnerability Analysis

Streamlink's HTTPSession extends the requests.Session class and registers a FileAdapter bound to the file:// scheme so that local media paths can be handled through the same request interface as network resources. The session inherits redirect-following behavior from requests.Session and does not restrict which schemes are permissible redirect targets. When Streamlink issues an HTTP or HTTPS request, an attacker-controlled server can respond with a 3xx redirect whose Location header points to a file:// URL. The session then dispatches the redirected request through the FileAdapter, reads the referenced file from disk, and returns the contents to the caller as if it were a normal HTTP response body.

This affects every request made through HTTPSession, including manifest fetches, segment fetches, and API calls made by service plugins. Direct file-URL guards previously added for HLS and DASH manifests do not apply because the initial request targets a legitimate network URL and the scheme transition happens later during redirect handling. A segment fetch abused this way places the local file contents directly into the decoded stream output consumed by the user's media player.

Root Cause

The root cause is missing validation of the destination scheme during redirect resolution in HTTPSession. The FileAdapter provides a legitimate mechanism for handling file:// URLs originating from user configuration, but combining it with unrestricted cross-protocol redirects allows a remote endpoint to pivot from http/https to file unilaterally.

Attack Vector

Exploitation requires that Streamlink fetch a URL controlled by the attacker. This occurs when a user runs Streamlink against a malicious streaming URL or a compromised service. The attacker's server returns an HTTP redirect with a Location header such as file:///etc/passwd or file:///home/user/.ssh/id_rsa. Streamlink follows the redirect through the FileAdapter, reads the local file, and delivers the contents either to internal parsing logic or to the stream output pipeline depending on which request triggered the redirect.

python

 from ipaddress import ip_address
 from pathlib import Path
 from typing import TYPE_CHECKING, Any, Protocol, TypeVar, cast, runtime_checkable
+from urllib.parse import urlparse
 
 import urllib3
 import urllib3.util.connection as urllib3_util_connection
-from requests import Request, Session
+from requests import Request, Response, Session
 from requests.adapters import HTTPAdapter
+from requests.exceptions import InvalidURL
 from urllib3.connection import HTTPConnection
 from urllib3.util import create_urllib3_context

Source: GitHub Streamlink Commit 4b99c64. The patch introduces urlparse and InvalidURL handling in src/streamlink/session/http.py to reject cross-protocol redirects to the file scheme.

Detection Methods for CVE-2026-92164

Indicators of Compromise

HTTP responses to Streamlink processes containing Location headers with file:// schemes
Streamlink processes performing local file reads on paths outside the user's configured media directories
Unexpected file contents (for example, /etc/passwd, SSH keys, configuration files) appearing in stream output or logs

Detection Strategies

Inspect proxy or TLS-terminating middlebox logs for 3xx responses returning file:// targets when the client User-Agent identifies Streamlink or python-requests
Correlate outbound HTTPS traffic from Streamlink hosts with subsequent reads of sensitive local files by the same process
Audit installed Streamlink versions across managed workstations and flag any release earlier than 8.6.0

Monitoring Recommendations

Enable file access auditing on sensitive paths (/etc, user home directories, credential stores) and alert when the Streamlink process accesses them
Monitor egress traffic from developer and media workstations for connections to unknown streaming endpoints followed by anomalous file reads
Track process execution telemetry for streamlink invocations against non-allowlisted URLs

How to Mitigate CVE-2026-92164

Immediate Actions Required

Upgrade Streamlink to version 8.6.0 or later on all systems and container images
Restrict Streamlink to trusted stream URLs and disable automated fetches of user-supplied or third-party URLs until patched
Run Streamlink under a low-privilege account with no read access to sensitive credentials or configuration files

Patch Information

The fix is available in the Streamlink 8.6.0 release. The corrective change is documented in the Streamlink security advisory GHSA-vf2x-4v53-pm7v and implemented in commit 4b99c64, which rejects redirects that transition from HTTP or HTTPS to the file scheme.

Workarounds

Route Streamlink traffic through an egress proxy that strips Location headers containing file:// schemes
Execute Streamlink inside a sandbox or container without bind-mounted secrets, so that any successful file read yields no sensitive data
Disable redirect following in downstream integrations that embed HTTPSession when connecting to untrusted services

bash

# Upgrade Streamlink using pip
python -m pip install --upgrade 'streamlink>=8.6.0'

# Verify the installed version
streamlink --version