What is CVE-2026-72571?
A Path Traversal vulnerability in mustafaakin/cast-localvideo allows an unauthenticated remote attacker to read arbitrary files from the server. The flaw exists in the app.js file where user-supplied 'req.body.dir' parameter is passed directly to 'res.sendFile()' without sanitization. Immediate input validation and sanitization are required.
Azərbaycanca: Bu, mustafaakin/cast-localvideo layihəsində aşkarlanmış Path Traversal zəifliyidir. Doğrulama olmadan istifadəçi tərəfindən göndərilən req.body.dir parametri res.sendFile() funksiyasına ötürüldüyü üçün autentifikasiya olunmamış uzaqdan hücumçu serverdəki ixtiyari faylları oxuya bilər. Təcili olaraq giriş parametrlərinin sanitizasiyasını həyata keçirmək tövsiyə edilir.
Related CVEs
link basis: same weakness class CWE-22
FAQ1
How can CVE-2026-72571 be exploited in the mustafaakin/cast-localvideo project?
The vulnerability exists in the app.js file where the user-supplied `req.body.dir` parameter is passed directly to `res.sendFile()` without any sanitization. This allows an unauthenticated remote attacker to perform a Path Traversal attack and read arbitrary files from the server.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.