Vulnerabilities

TI-2026-56038 CVE-2026-81028 · GHSA-4j5x-jgmh-j582

ZLMediaKit downloadFile Root-Directory Confinement Bypass via Prefix Collision

LOW 31

ZLMediaKit confines the downloadFile API to a configured set of root directories with a prefix comparison that does not account for directory boundaries.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.00515 Published 2026-08-26 No fix listed CWE-22

TI-2026-27356 CVE-2026-35203

ZLMediaKit VP9 RTP Parser Out-of-Bounds Read

HIGH 72

ZLMediaKit is a streaming media service framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00359 Published 2026-04-06 Fixed in 435dcbc CWE-125

TI-2023-20282 CVE-2023-39067 · GHSA-7ggr-xmp8-v34h

Cross Site Scripting vulnerability in ZLMediaKiet v.4.0 and v.5.0 allows an attacker to…

LOW 27

Cross Site Scripting vulnerability in ZLMediaKiet v.4.0 and v.5.0 allows an attacker to execute arbitrary code via a crafted script to the URL.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00395 Published 2023-09-11 No fix listed CWE-79

TI-2023-15246 CVE-2023-31861 · GHSA-qvq6-m5vj-xm45

ZLMediaKit 4.0 is vulnerable to Directory Traversal.

MEDIUM 41

ZLMediaKit 4.0 is vulnerable to Directory Traversal.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01136 Published 2023-05-25 No fix listed CWE-22

TI-2022-17354 CVE-2022-37237 · GHSA-wg85-4484-2x94

An attacker can send malicious RTMP requests to make the ZLMediaKit server crash remotely.

LOW 34

An attacker can send malicious RTMP requests to make the ZLMediaKit server crash remotely.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00815 Published 2022-08-30 No fix listed

Vulnerabilities

Filters

ZLMediaKit downloadFile Root-Directory Confinement Bypass via Prefix Collision

ZLMediaKit VP9 RTP Parser Out-of-Bounds Read

Cross Site Scripting vulnerability in ZLMediaKiet v.4.0 and v.5.0 allows an attacker to…

ZLMediaKit 4.0 is vulnerable to Directory Traversal.

An attacker can send malicious RTMP requests to make the ZLMediaKit server crash remotely.