{"id":"CVE-2026-121629","kind":"vulnerability","aliases":["CVE-2026-121629"],"related":[],"title":"GStreamer: adaptive streaming demuxers read local files via file:// manifest URIs","description":"A flaw was found in GStreamer's adaptive streaming demuxers (HLS, DASH, MSS). When processing a media playlist or manifest, URIs referenced in the manifest content are fetched without restricting which URI schemes are permitted. An attacker who controls a manifest URL, or who can inject content into an HTTP manifest response, can include file:// URIs pointing to arbitrary local files, causing the affected application to read and process those files. In automated or server-side deployments such as media recorders, proxies, and downloaders, this can lead to disclosure of sensitive local files. Existence of files can also be inferred through differing error responses even when content is not directly observable.","summary":"GStreamer's HLS, DASH and MSS demuxers fetch URIs listed inside a manifest without limiting the URI scheme, so file:// entries are followed. An attacker who controls a manifest URL or can inject content into an HTTP manifest response can read arbitrary local files or infer whether they exist.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"gst-plugins-good","fixed":["1.28.9"],"affected":"< 1.28.9","ecosystem":"gstreamer"}],"ecosystems":[],"tags":["dash","gst-plugins-good","gstreamer","hls","media-server","package","self-hosted"],"not_affected_if":["local-playback-only","no-untrusted-manifests"],"how_to_check":"Run gst-inspect-1.0 --version or check your package manager for gst-plugins-good; versions before 1.28.9 are affected (Red Hat says builds below 1.26.0 are not). Also check any app that links GStreamer and opens HLS/DASH manifests from untrusted URLs.","fix":"Upgrade gst-plugins-good to 1.28.9 (patch: MR 12990). For older builds, apply the patch and recompile.","status":"open","published_at":"2026-11-09T12:16:37+00:00","first_seen_at":"2026-11-09T12:26:23+00:00","triaged_at":"2026-11-09T12:27:22+00:00","updated_at":"2026-11-09T12:28:59+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-09T12:27:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"GStreamer: adaptive streaming demuxers read local files via file:// manifest URIs","impact":"medium","summary":"GStreamer's HLS, DASH and MSS demuxers fetch URIs listed inside a manifest without limiting the URI scheme, so file:// entries are followed. An attacker who controls a manifest URL or can inject content into an HTTP manifest response can read arbitrary local files or infer whether they exist.","audience":"developers","category":"package","nicknames":[],"who_cares":["gstreamer","media-server","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"local files readable by the process, and file existence inferred","analyst_note":"Find the affected and fixed GStreamer versions and any upstream patch from the NVD entry or GStreamer advisories; the sources give none.","how_to_check":"- Check whether the application uses GStreamer's `hlsdemux`, `dashdemux` or `mssdemux` elements, or a `playbin` that plays HLS, DASH or MSS streams\n- Check the installed GStreamer version with `gst-inspect-1.0 --version`\n- unknown: the sources do not give the affected version ranges","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-manifests","local-playback-only"],"who_is_affected":"Server-side or automated deployments that fetch and parse adaptive streaming manifests from URLs they do not fully control, such as media recorders, proxies and downloaders, are the exposed case. Applications that only play trusted, local or fixed-source media are less likely to be reachable. unknown for the exact affected versions and configurations.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000782,"input_tokens":4668,"output_tokens":631,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed GStreamer versions and any upstream patch from the NVD entry or GStreamer advisories; the sources give none.","search":"'-121629':13A,16A '-2026':12A,15A 'adapt':2A,90C 'affect':145C 'also':180C 'applic':146C 'arbitrari':75B,140C 'attack':58B,119C 'autom':154C 'caus':143C 'content':67B,108C,129C,189C 'control':60B,121C 'cve':11A,14A 'dash':21B,38B,94C 'demux':4A,41B,92C 'deploy':159C 'differ':184C 'direct':192C 'disclosur':171C 'download':166C 'entri':54B 'error':185C 'even':187C 'exist':82B,176C 'fetch':42B,110C 'file':7A,77B,142C,152C,175C,178C 'flaw':84C 'follow':56B 'found':86C 'good':20A,25B 'gst':18A,23B 'gst-plugins-good':17A,22B 'gstreamer':1A,26B,35B,88C 'hls':27B,37B,93C 'host':34B 'http':70B,132C 'includ':136C 'infer':79B,182C 'inject':66B,128C 'insid':45B 'lead':169C 'limit':49B 'list':44B 'local':6A,76B,141C,174C 'manifest':9A,47B,62B,71B,102C,107C,123C,133C 'media':29B,99C,162C 'media-serv':28B 'mss':40B,95C 'observ':193C 'packag':31B 'permit':117C 'playlist':100C 'plugin':24B 'plugins':19A 'point':138C 'process':97C,150C 'proxi':164C 'read':5A,74B,148C 'record':163C 'referenc':104C 'respons':72B,134C,186C 'restrict':112C 'scheme':52B,115C 'self':33B 'self-host':32B 'sensit':173C 'server':30B,157C 'server-sid':156C 'side':158C 'stream':3A,91C 'uri':10A,43B,51B,103C,114C,137C 'url':63B,124C 'via':8A 'whether':80B 'without':48B,111C","nicknames":[],"mitigations":[],"who_affected":"Applications using GStreamer's adaptive streaming demuxers (HLS and DASH; NVD also lists MSS) to fetch manifests from URLs or networks an attacker can influence are exposed: media recorders, proxies, downloaders and other server-side tools. A crafted manifest with file:// entries makes them read local files, or reveal whether files exist. Local playback of trusted media can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-09T12:28:59Z","by":"analyst","doc":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12990","run_id":2283},"products":{"at":"2026-11-09T12:28:59Z","by":"analyst","doc":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12990","run_id":2283},"who_affected":{"at":"2026-11-09T12:28:59Z","by":"analyst","doc":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12990","run_id":2283}},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["gstpluginsgood"],"ptokens":["good","gst","plugins"],"labels":["dash","gstpluginsgood","gstreamer","high","hls","mediaserver","package","selfhosted"],"campaign_type":null,"search_a":"'-121629':13A,16A '-2026':12A,15A 'adapt':2A 'cve':11A,14A 'demux':4A 'file':7A 'good':20A 'gst':18A 'gst-plugins-good':17A 'gstreamer':1A 'local':6A 'manifest':9A 'plugins':19A 'read':5A 'stream':3A 'uri':10A 'via':8A","search_b":"'arbitrari':75B 'attack':58B 'content':67B 'control':60B 'dash':21B,38B 'demux':41B 'entri':54B 'exist':82B 'fetch':42B 'file':77B 'follow':56B 'good':25B 'gst':23B 'gst-plugins-good':22B 'gstreamer':26B,35B 'hls':27B,37B 'host':34B 'http':70B 'infer':79B 'inject':66B 'insid':45B 'limit':49B 'list':44B 'local':76B 'manifest':47B,62B,71B 'media':29B 'media-serv':28B 'mss':40B 'packag':31B 'plugin':24B 'read':74B 'respons':72B 'scheme':52B 'self':33B 'self-host':32B 'server':30B 'uri':43B,51B 'url':63B 'whether':80B 'without':48B","search_c":"'adapt':90C 'affect':145C 'also':180C 'applic':146C 'arbitrari':140C 'attack':119C 'autom':154C 'caus':143C 'content':108C,129C,189C 'control':121C 'dash':94C 'demux':92C 'deploy':159C 'differ':184C 'direct':192C 'disclosur':171C 'download':166C 'error':185C 'even':187C 'exist':176C 'fetch':110C 'file':142C,152C,175C,178C 'flaw':84C 'found':86C 'gstreamer':88C 'hls':93C 'http':132C 'includ':136C 'infer':182C 'inject':128C 'lead':169C 'local':141C,174C 'manifest':102C,107C,123C,133C 'media':99C,162C 'mss':95C 'observ':193C 'permit':117C 'playlist':100C 'point':138C 'process':97C,150C 'proxi':164C 'read':148C 'record':163C 'referenc':104C 'respons':134C,186C 'restrict':112C 'scheme':115C 'sensit':173C 'server':157C 'server-sid':156C 'side':158C 'stream':91C 'uri':103C,114C,137C 'url':124C 'without':111C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T12:16:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121629","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121629","severity":null,"published_at":"2026-11-09T12:16:37+00:00","modified_at":"2026-11-09T12:16:37+00:00","first_seen_at":"2026-11-09T12:26:23+00:00","fetched_at":"2026-11-09T12:26:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121629:2283","url":"https://gstreamer.freedesktop.org/security/sa-2026-0097.html","severity":null,"published_at":"2026-11-09T12:28:59+00:00","modified_at":"2026-11-09T12:28:59+00:00","first_seen_at":"2026-11-09T12:28:59+00:00","fetched_at":"2026-11-09T12:28:59+00:00","note":"GStreamer-SA-2026-0097 (primary) read: affected gst-plugins-good < 1.28.9, fixed 1.28.9, MR 12990. Red Hat page lists mitigations (avoid untrusted manifests, sandbox filesystem, restrict manifest hosts) which do not remove the flaw; Red Hat says <1.26 not affected, advisory says only 'before 1.28.9'. Advisory names HLS/DASH only; NVD/Red Hat add MSS (unconfirmed by vendor). web-cli search unavailable (Exa credits), X not checked. No exploitation or PoC seen. how_to_check not verified (my wording).","cites":["https://gstreamer.freedesktop.org/security/sa-2026-0097.html","https://access.redhat.com/security/cve/CVE-2026-121629","https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12990"]}],"documents":[{"id":107404,"url":"https://gstreamer.freedesktop.org/security/sa-2026-0097.html","title":"GStreamer-SA-2026-0097","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":107405,"url":"https://access.redhat.com/security/cve/CVE-2026-121629","title":"Red Hat CVE-2026-121629","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null},{"id":107406,"url":"https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/12990","title":"GStreamer MR 12990 (fix)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}