CVE-2026-77385 in Kyoo
Summary
by MITRE • 09/18/2026
Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, a registered user with the core.play permission could supply a base64-encoded filesystem path to the transcoder. The path handling in transcoder/src/api/path.go cleaned the value and checked only that it began with Settings.SafePath before getHash processed it, while transcoder/src/api/streams.go served the accepted path without verifying a Kyoo catalog record. This missing catalog-level authorization allowed the user to retrieve hidden, temporary, operational, or other uncataloged files beneath the media directory when the path was known or guessed. This vulnerability is fixed in 5.1.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in Kyoo versions prior to 5.1.0 represents a critical authorization failure within the application's transcoder module, specifically affecting users who possess the core.play permission. As a self-hosted media server designed for movies, series, and anime, Kyoo relies on strict access controls to ensure that users can only interact with content explicitly added to their personal or shared catalogs. However, the architecture of the transcoder API contained a significant flaw in how it validated file paths before processing them for playback. This design oversight allowed authenticated users to bypass intended catalog-level restrictions by manipulating input parameters related to filesystem navigation.
The technical root cause lies in the insufficient validation logic within the path handling mechanisms located in transcoder/src/api/path.go and transcoder/src/api/streams.go. When a user requested media transcoding, they could supply a base64-encoded filesystem path as part of the request payload. The application's initial sanitization routine performed only a superficial check to ensure that this decoded path began with the configured SafePath prefix. This validation was intended to prevent arbitrary file access by restricting operations to within specific directories. However, this check occurred before the getHash function processed the value and critically failed to verify whether the requested resource actually existed as a valid record in the Kyoo catalog database. Consequently, if an attacker could guess or determine the existence of files located beneath the media directory but outside the user's authorized scope, they could successfully retrieve them.
This lack of catalog-level authorization effectively transforms what might appear to be a simple path traversal issue into a broader information disclosure vulnerability. Because the system served accepted paths without cross-referencing against the application's internal metadata and access control lists, users were able to access hidden files, temporary operational data, or other uncataloged content stored within the media directory structure. The reliance on base64 encoding for path submission further complicates detection by standard web application firewalls that may not decode such inputs prior to inspection. The impact is particularly severe in multi-user environments where sensitive metadata, configuration backups, or private user files might reside alongside public media assets, leading to unauthorized data exposure and potential compromise of system integrity if operational files are accessed.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control, as the application failed to enforce proper authorization checks for resources under its control. It also relates closely to CWE-732 Incorrect Permission Assignment for Critical Resource, given that the transcoder endpoint exposed sensitive filesystem locations without adequate verification of user entitlements relative to those specific files. In terms of adversary tactics, this flaw facilitates reconnaissance and data exfiltration phases within the MITRE ATT&CK framework, specifically under techniques such as T1083 File and Directory Discovery or T1537 Transfer Data to Cloud Account if combined with external upload capabilities, although primarily it serves local information gathering.
To mitigate this vulnerability, organizations running Kyoo must immediately upgrade to version 5.1.0 or later, where the path validation logic has been corrected to enforce strict catalog-level authorization checks before serving any file content. Until an upgrade is feasible, administrators should implement network-level controls such as web application firewalls configured to inspect and decode base64 parameters in API requests, blocking those that attempt to access paths outside of explicitly whitelisted directories. Additionally, reviewing the permissions assigned to users with core.play rights can help limit exposure by ensuring only trusted accounts have transcoder access, thereby reducing the attack surface available for exploitation through path manipulation techniques.