CVE-2026-81028

Name of the Vulnerable Software and Affected Versions ZLMediaKit (affected versions not specified)

Description The downloadFile API endpoint fails to properly validate directory boundaries when restricting file access to configured root directories. The system uses a prefix comparison that does not ensure the root path ends with a directory separator. Consequently, an attacker can access sibling directories whose names start with the same string as the configured root. The only existing restriction prevents the use of two dots (..) in the path, which does not stop this specific traversal. This issue allows the reading of files outside the intended restricted directories.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.