StreamVault CVE-2025-66203

Exploitation requires authenticated administrator access to the stream-vault admin interface and the yt-dlp supplemental-arguments configuration feature exposed at /admin/api/saveConfig; the injected arguments are stored globally and only execute when yt-dlp is subsequently invoked (e.g., a download job) with the command line assembled in YtDlpUtil.java. Affected versions are StreamVault prior to 251126. Limiting factors: admin-level authentication (CVSS PR:H) is mandatory, so this is not reachable by anonymous remote attackers; the vulnerable append-arguments feature was removed entirely in the fixed release, so patched/current deployments are not exposed.

This is a genuine but access-gated remote code execution flaw (CWE-78 OS command injection). The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, base 9.1) materially inflates urgency relative to real-world risk because PR:H means the attacker must already hold administrator privileges to reach /admin/api/saveConfig. Public exploit code exists (GitHub Security Advisory GHSA-c747-q388-3v6m), which raises exploitability, but there is NO CISA KEV listing and NO EPSS score in the input, so there is no evidence of widespread or active exploitation - treat the POC as proof of feasibility, not of in-the-wild abuse. The high-privilege prerequisite plus the product's niche footprint (an independent GitHub video-download project) means this is a prioritize-if-you-run-it issue rather than a mass-exploitation emergency. Conflicting signal to verify: the input marks scope-changed (S:C), but the injected arguments execute yt-dlp as the application itself, so a same-scope (S:U) interpretation is defensible - this is the main driver of the 9.1 score and worth confirming with the vendor advisory. Note also a reference inconsistency: the description says fixed in 251126 while the linked release tag is 251226 (which removed the vulnerable feature).

An authenticated administrator - or an attacker who has compromised admin credentials or hijacked an admin session - submits crafted yt-dlp arguments to the /admin/api/saveConfig endpoint. Because the arguments are stored globally and concatenated unvalidated into the command line built in YtDlpUtil.java, the next yt-dlp invocation executes attacker-controlled OS commands on the host as the application user. A public exploit for this path is available via the vendor's GitHub Security Advisory.