Executive brief
ZLMediaKit is a multimedia server framework that provides file download APIs. The downloadFile endpoint fails to properly validate that requested file paths stay within configured root directories, allowing authenticated attackers to read arbitrary files on the server by exploiting a flaw in path prefix checking. This can expose sensitive configuration, media files, and system data outside the intended directory boundaries.
Technical details
The vulnerability is a path traversal flaw in the downloadFile API handler in server/WebApi.cpp. The configuration loader builds root directory paths using File::absolutePath("", item, true) with an empty relative-path argument, which omits a trailing path separator. The access control check then uses start_with(file_path, root) comparison, allowing an attacker to request paths in sibling directories whose names begin with the configured root string (e.g., configured root "/data" accepts "/data_secret/file.txt"). The check for ".." in paths provides no additional protection. The API requires a valid secret key, so exploitation requires already-authenticated access; however, this grants unauthorized file read beyond the configured confinement. A similar check in src/Http/HttpFileManager.cpp is not affected because it appends the separator before comparison.
Affected products
- ZLMediaKit ZLMediaKit <UNKNOWN>
Timeline
- 2026-08-26: disclosed: CVE-2026-81028 published to NVD