CVE-2026-72571

Name of the Vulnerable Software and Affected Versions mustafaakin/cast-localvideo (affected versions not specified)

Description A path traversal issue allows an unauthenticated remote attacker to read arbitrary files from the server. The app.js handler passes the user-supplied req.body.dir parameter directly to the res.sendFile() function without proper sanitization. This allows the use of absolute paths or ../ sequences to access sensitive system files. Path traversal is a technique used to access files and directories that are stored outside the web root folder.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the req.body.dir parameter in the affected handler until the issue is resolved.