CVE-2025-34452

Name of the Vulnerable Software and Affected Versions Streama versions 1.10.0 through 1.10.5 Streama versions prior to commit b7c8767

Description Streama is affected by path traversal and server-side request forgery (SSRF) issues in its subtitle download functionality. An authenticated attacker can write arbitrary files to the server filesystem by exploiting insufficient validation of user-controlled parameters used to fetch remote content and construct file paths. Specifically, crafting a subtitle download URL with a path traversal sequence in the file name allows an attacker to write files to arbitrary locations, potentially leading to remote code execution.

Recommendations Update Streama to a version after commit b7c8767. For Streama versions 1.10.0 through 1.10.5, ensure proper validation of user-controlled parameters used in the subtitle download functionality.