ZLMediaKit CVE-2026-81028

Exploitation requires prior possession of the configured ZLMediaKit API secret; the secret check executes before the path traversal logic, and without it the endpoint rejects all requests (CVSS PR:H). The attacker must also know or enumerate sibling directory names that share a prefix with the configured root - knowledge of the server's filesystem layout is therefore a secondary prerequisite. The vulnerability is strictly limited to the downloadFile API handler in server/WebApi.cpp; the standard static file server is not affected. The attack produces read-only access - no write, delete, or code-execution primitive is exposed by this flaw alone. The impact ceiling is bounded by the OS privileges of the ZLMediaKit process: the reference container runs as root (maximum exposure), but deployments using a dedicated non-root service account would expose only files readable by that account.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/VC:H) correctly captures the core tension: this is a network-accessible endpoint but is gated behind a high-privilege API secret, substantially narrowing the realistic attacker population to insiders, credential-theft victims, or environments where the secret has been inadvertently exposed. The confidentiality impact is rated High because the reference container runs as root, meaning a successful exploitation exposes the full host filesystem - private keys, environment files, and operator credentials included - with no integrity or availability impact. No EPSS score was provided and the vulnerability is not listed in the CISA KEV catalog; no public exploit code has been identified at time of analysis. The overall risk posture is moderate rather than critical: this is not a zero-authentication flaw that mass scanners would opportunistically exploit, and any deployment where the API secret is tightly controlled faces a substantially lower practical risk than the impact ceiling suggests. However, operators running ZLMediaKit as root in containerized environments who have broadly shared or logged the API secret should treat remediation as urgent, since the attack is low-complexity once the secret is known.

An attacker who has obtained the ZLMediaKit API secret - through credential theft, log exposure, or insider access - sends an authenticated HTTP request to the downloadFile endpoint specifying a path such as /srv/media-private/app.env, where /srv/media is the configured root. Because the prefix check compares /srv/media against /srv/media-private without a separator, the guard passes and the server returns the file contents. No dot-dot sequences are required, and if the process runs as root the attacker can target any readable file on the host.