Home

Description

Streama versions 1.10.0 through 1.10.5 and prior to commit b7c8767 contain a combination of path traversal and server-side request forgery (SSRF) vulnerabilities in that allow an authenticated attacker to write arbitrary files to the server filesystem. The issue exists in the subtitle download functionality, where user-controlled parameters are used to fetch remote content and construct file paths without proper validation. By supplying a crafted subtitle download URL and a path traversal sequence in the file name, an attacker can write files to arbitrary locations on the server, potentially leading to remote code execution.

PUBLISHED Reserved 2025-04-15 | Published 2025-12-18 | Updated 2025-12-18 | Assigner VulnCheck




HIGH: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N

Problem types

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-918 Server-Side Request Forgery (SSRF)

Product status

Default status
unaffected

1.10.0 (semver)
affected

commit b7c8767 (custom)
unaffected

Credits

Valentin Lobstein (Chocapikk) finder

References

github.com/streamaserver/streama/commit/b7c8767 patch

chocapikk.com/posts/2025/streama-path-traversal-ssrf/ technical-description exploit

www.vulncheck.com/...nd-ssrf-leading-to-arbitrary-file-write third-party-advisory

cve.org (CVE-2025-34452)

nvd.nist.gov (CVE-2025-34452)

Download JSON

Data based on CVE®. Copyright © 1999-2025, The MITRE Corporation. All rights reserved.