6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44353

CVE-2026-44353: Streamlink: Arbitrary local file read via file:// URI in HLS and DASH

Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.4.0, Streamlink's HLS and DASH parsers do not validate the URI scheme of segment entries and other resources. A remote .m3u8 HLS playlist or .mpd DASH manifest can list file:///path/to/file as a segment, and streamlink will read that local file and write its contents to the output stream. This vulnerability is fixed in 8.4.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44353

CVE-2026-44353:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
streamlink	pip	<= 8.3.0	8.4.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an arbitrary local file read due to a lack of URI scheme validation in Streamlink's HLS and DASH parsers. A malicious remote playlist (.m3u8) or manifest (.mpd) could include segment URIs with the 'file://' scheme. The Streamlink client, when processing this manifest, would then attempt to read the specified local file and write its contents to the output stream.

The analysis of the commits between the vulnerable version (8.3.0) and the patched version (8.4.0) reveals the exact fix. The developers introduced a new utility function, is_insecure_scheme, to explicitly forbid transitions from remote schemes (like 'http' or 'https') to local ones ('file').

This check was then implemented in the core parsing logic for both HLS and DASH streams:

For HLS, the M3U8Parser.uri function, which resolves all URIs within a playlist, was modified to use is_insecure_scheme and raise an error if an invalid scheme is detected.
For DASH, the fix was applied in multiple places. The MPDNode.base_url property was updated to validate schemes when resolving BaseURL tags. Furthermore, the methods responsible for generating the final segment URLs (SegmentBase.segments and SegmentTemplate.segments) were updated to use a new, secure make_url function that performs the scheme validation.

Therefore, the identified vulnerable functions are the ones that, prior to the patch, processed or constructed these URIs without validation. During exploitation, these functions would appear in a runtime profile as they handle the malicious 'file://' URIs from the attacker-controlled manifest.

Vulnerable functions

M3U8Parser.uri

src/streamlink/stream/hls/m3u8.py

This function is responsible for resolving URIs from an HLS (m3u8) playlist. Prior to the patch, it did not validate the URI scheme, allowing a remote playlist to specify a 'file://' URI for a segment. The stream worker would then read the local file specified and include its content in the output stream.

MPDNode.base_url

src/streamlink/stream/dash/manifest.py

This property resolves the BaseURL from a DASH (mpd) manifest. The vulnerable version would join a new BaseURL from the manifest with the parent URL without validating the scheme. This allowed a malicious manifest to set a 'file://' path as the base for subsequent segment URLs, leading to local file reads.

SegmentBase.segments

src/streamlink/stream/dash/manifest.py

This method generates segment objects for a DASH stream. It was vulnerable because it used an insecure method to construct the final segment URI. The patch changes the call to a new `make_url` function that validates the scheme, preventing the use of 'file://' URIs from a remote manifest.

SegmentTemplate.segments

src/streamlink/stream/dash/manifest.py

This method generates DASH segments from a template. Similar to `SegmentBase.segments`, it was responsible for constructing segment URLs. The vulnerable version did so without validating the URI scheme, allowing a malicious manifest to template 'file://' URIs and trigger local file reads.

is_insecure_scheme

src/streamlink/utils/url.py

This new function was added as part of the fix. It is not a vulnerable function itself, but it is a key runtime indicator that the security mitigation is in place. It is called by the patched parser functions to check for disallowed URI scheme transitions, such as from 'http' to 'file'.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.