Quick answers
- Is CVE-2026-81028 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-81028 being exploited in the wild.
- How severe is CVE-2026-81028?
- Medium severity, with a CVSS score of 4.9, published 26 August 2026.
- Which products and versions are affected?
- Zlmediakit <UNKNOWN>.
- Is there a fix for CVE-2026-81028?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-81028 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-81028?
- Check whether you run Zlmediakit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a path traversal flaw in the downloadFile API handler in server/WebApi.cpp. The configuration loader builds root directory paths using File::absolutePath("", item, true) with an empty relative-path argument, which omits a trailing path separator. The access control check then uses start_with(file_path, root) comparison, allowing an attacker to request paths in sibling directories whose names begin with the configured root string (e.g., configured root "/data" accepts "/data_secret/file.txt"). The check for ".." in paths provides no additional protection. The API requires a valid secret key, so exploitation requires already-authenticated access; however, this grants unauthorized file read beyond the configured confinement. A similar check in src/Http/HttpFileManager.cpp is not affected because it appends the separator before comparison.
Affected products
- ZLMediaKit ZLMediaKit <UNKNOWN>
Timeline
- 2026-08-26: disclosed: CVE-2026-81028 published to NVD