Executive brief
Streama, an open-source media streaming server, contains a security flaw in its subtitle download feature. An authenticated user can exploit this to force the server to download malicious files from an external source and save them to any location on the server's filesystem. This could allow an attacker to overwrite critical system files, corrupt the database, or potentially take full control of the server.
Technical details
The vulnerability exists within the `SubtitlesController.download()` endpoint and the `OpensubtitlesService.downloadSubtitles()` function. The application fails to validate the `subDownloadLink` parameter, allowing an SSRF to fetch arbitrary remote content. Simultaneously, the `subFileName` parameter is used in `ZipHelper.unzipFile()` without sanitization, enabling path traversal (CWE-22). By chaining these, an authenticated attacker can fetch a malicious payload via SSRF and write it to an arbitrary location on the filesystem. While direct Remote Code Execution (RCE) was not demonstrated in the initial report, the ability to write arbitrary files (such as SSH keys or cron jobs) provides a clear path to full system compromise. The issue is fixed in commit b7c8767 by implementing URL whitelisting and canonical path validation.
Affected products
- Streama Streama 1.10.0 through 1.10.5, prior to commit b7c8767
Timeline
- 2025-12-18: disclosed: Vulnerability details published by researcher Valentin Lobstein
- 2025-12-18: patched: Fix committed to repository in b7c8767
- 2025-12-18: advisory: CVE-2025-34452 published