CVE-2026-44353 Streamlink: Arbitrary local file read via file:// URI in HLS and DASH
Attackers can read arbitrary local files by crafting malicious HLS or DASH manifests with file:// URIs, exposing sensitive data to anyone using Streamlink.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-44353?
CVE-2026-44353 is a medium-severity path traversal vulnerability in streamlink, published on 27 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.4.0, Streamlink's HLS and DASH parsers do not validate the URI scheme of segment entries and other resources. A remote .m3u8 HLS playlist or .mpd DASH manifest can list file:///path/to/file as a segment, and streamlink will read that local file and write its contents to the output stream. This vulnerability is fixed in 8.4.0.
Weakness: CWE-22
Which versions are affected by CVE-2026-44353?
3 open source packages ship an affected version, including streamlink. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
streamlink PyPI | All versions | 8.4.0 |
streamlink PyPI | All versions | 8.4.0 |
streamlink PyPI | All versions | 8.4.0 |
Linux distribution packages (1)
streamlink openSUSE:Tumbleweed | All versions | 8.4.0-1.1 |
Products include Streamlink Streamlink.
How do I fix CVE-2026-44353?
Upgrade streamlink to 8.4.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-44353 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44353 exists.
Sources
Also known as DEBIAN-CVE-2026-44353, GHSA-hgqw-6m45-hw5f, PYSEC-2026-180, UBUNTU-CVE-2026-44353, openSUSE-SU-2026:10733-1.