Live › vulnerability › CVE-2026-111728
Go to dashboardSeanime versions 3.7.0 through 3.10.3 let unauthenticated clients on the local network or Tailnet set custom ffmpeg decode and encode flags that are passed verbatim to ffmpeg. An attacker can use this to write or truncate arbitrary files as the user running Seanime, and possibly read local files or send data outbound through ffmpeg protocol handlers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Seanime installs in the affected range that are reachable by other devices on the local network or a Tailnet are exposed, because the flaw is reachable without authentication. Instances that are only reachable on the machine itself, or that run outside this version range, are not described as affected. Whether the transcode custom setting must be enabled to be exploitable is implied by the description but not fully confirmed.
No product ranges from the sources yet.
3.7.0 and 3.10.3transcodeHwAccel is set to custom in the Seanime configuration3.10.3 (the fixed version is not stated in the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Seanime v3.7.0 to v3.10.3 contains an argument injection vulnerability reachable through improper authorization, allowing unauthenticated LAN or Tailnet clients to bypass the privileged mediastream settings guard by setting transcodeHwAccel to custom and supplying attacker-controlled decodeFlags and encodeFlags via the transcodeHwAccelCustomSettings field, which are appended verbatim to the ffmpeg argument vector. Attackers can trigger execution via the mediastream request and HLS playlist endpoints to achieve arbitrary file write and file truncation on the host as the user running seanime, with the injected input options also enabling potential arbitrary local file read and outbound data exfiltration through ffmpeg's protocol handlers.
This page as .md · .json · in your agent: get_signal("CVE-2026-111728")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.