Cast Localvideo
Monthly
Path traversal in mustafaakin/cast-localvideo (all versions) exposes arbitrary server files to unauthenticated remote attackers with trivial effort. The Node.js HTTP handler in app.js at lines 151-153 passes the user-supplied `req.body.dir` parameter directly to `res.sendFile()` without any path sanitization, permitting `../` sequences or absolute paths to escape the intended directory. No patch has been identified at time of analysis, no public exploit has been confirmed, and the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector means any internet-facing deployment is trivially exploitable.
Path traversal in mustafaakin/cast-localvideo (all versions) exposes arbitrary server files to unauthenticated remote attackers with trivial effort. The Node.js HTTP handler in app.js at lines 151-153 passes the user-supplied `req.body.dir` parameter directly to `res.sendFile()` without any path sanitization, permitting `../` sequences or absolute paths to escape the intended directory. No patch has been identified at time of analysis, no public exploit has been confirmed, and the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector means any internet-facing deployment is trivially exploitable.