Executive brief
Kyoo is a self-hosted media server for organizing movies, series, and anime. A registered user with playback permissions could craft requests to access files on the server's storage that are not part of the media library, such as temporary or system files, by bypassing authorization checks in the transcoding component.
Technical details
A registered user with core.play permission could provide a base64-encoded filesystem path to the transcoder. The path validation in transcoder/src/api/path.go checked only that the decoded path began with Settings.SafePath, but transcoder/src/api/streams.go served the path without verifying it corresponded to a Kyoo catalog record, allowing access to arbitrary files beneath the media directory. The vulnerability affects versions prior to 5.1.0, which added file type validation to restrict transcoding to video files only.
Affected products
- Kyoo Kyoo before 5.1.0
Timeline
- 2026-09-18: disclosed
- 2026-07-12: patched