What is the CVSS score of CVE-2026-72571?

CVE-2026-72571 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.8%.

Which versions of cast-localvideo are affected by CVE-2026-72571?

mustafaakin/cast-localvideo contains an unauthenticated remote vulnerability allowing attackers to download arbitrary files from affected servers, including configuration data, credentials, and…

How to fix or mitigate CVE-2026-72571?

Immediately (within 24 hours): Identify all servers and applications running mustafaakin/cast-localvideo; document which ones are internet-facing; implement network-level protections including firewall rules and Web Application Firewall (WAF) configured to block path traversal patterns (../, URL-encoded variants, absolute paths) in HTTP requests to the vulnerable service. Within 7 days: Conduct forensic analysis of server access logs from the past 90 days to identify any suspicious file access patterns indicative of exploitation; if the service is not business-critical, disable or remove it; patch the underlying Node.js runtime and audit application dependencies for other known vulnerabilities. Within 30 days: Evaluate replacement libraries or custom implementations to retire mustafaakin/cast-localvideo; if retention is required, implement a hardened reverse proxy (nginx or Apache) with strict input validation and chroot/jailed file serving, plus continuous monitoring for exploitation attempts using intrusion detection signatures.

cast-localvideo CVE-2026-72571

EUVD-2026-55235 HIGH

Path Traversal (CWE-22)

2026-08-10 TuranSec

GHSA-2cj2-3364-qxxf

Path Traversal Cast Localvideo

7.5

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-accessible with zero authentication and no complexity required; impact is confidentiality-only (arbitrary file read) with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 10, 2026 - 11:19 vuln.today

CVE Published

Aug 10, 2026 - 10:40 cve.org

HIGH 7.5

DescriptionCVE.org

A path traversal vulnerability in mustafaakin/cast-localvideo (all versions) allows an unauthenticated remote attacker to read arbitrary files from the server. The app.js handler at lines 151-153 passes the user-supplied req.body.dir parameter directly to res.sendFile() without sanitization, enabling directory traversal via absolute paths or ../ sequences to read sensitive system files.

AnalysisAI

Path traversal in mustafaakin/cast-localvideo (all versions) exposes arbitrary server files to unauthenticated remote attackers with trivial effort. The Node.js HTTP handler in app.js at lines 151-153 passes the user-supplied req.body.dir parameter directly to res.sendFile() without any path sanitization, permitting ../ sequences or absolute paths to escape the intended directory. No patch has been identified at time of analysis, no public exploit has been confirmed, and the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector means any internet-facing deployment is trivially exploitable.

Technical ContextAI

cast-localvideo is a Node.js application that serves local video content over HTTP. The vulnerability is rooted in CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal): the Express.js res.sendFile() method in app.js lines 151-153 receives the raw req.body.dir POST parameter without normalization, allowlisting, or prefix enforcement, allowing attackers to supply values such as /etc/passwd or ../../../../etc/shadow. Node.js's res.sendFile() will faithfully resolve and serve any file the process has read permissions on. The affected CPE cpe:2.3:a:mustafaakin:cast-localvideo:*:*:*:*:*:*:*:* covers all released versions with no lower or upper bound.

RemediationAI

No vendor-released patch has been identified at time of analysis. The most effective immediate control is restricting cast-localvideo to listen only on localhost or a trusted private network interface, eliminating the network attack vector entirely without impacting local use cases. If network exposure is operationally required, place the service behind an authenticated reverse proxy (e.g., nginx with HTTP Basic Auth or mutual TLS) to enforce authentication and optionally filter traversal sequences before they reach the application - note that proxy-level filtering of path traversal is fragile and should be treated as defense-in-depth, not a primary control. As a code-level fix, the req.body.dir parameter should be validated using path.resolve() against an allowlisted base directory with a strict prefix check before being passed to res.sendFile(), or replaced with an index-based selection mechanism that never accepts raw filesystem paths from user input. Monitor https://github.com/mustafaakin/cast-localvideo for any upstream patch.