Description

A path traversal vulnerability in mustafaakin/cast-localvideo (all versions) allows an unauthenticated remote attacker to read arbitrary files from the server. The app.js handler at lines 151-153 passes the user-supplied req.body.dir parameter directly to res.sendFile() without sanitization, enabling directory traversal via absolute paths or ../ sequences to read sensitive system files.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-10T11:17:29.760Z",
  "pubdate": "2026-08-10T11:17:29.760Z",
  "executiveSummary": "A path traversal vulnerability exists in all versions of mustafaakin/cast-localvideo, specifically within the app.js handler at lines 151-153. This flaw allows an unauthenticated remote attacker to read arbitrary files from the underlying server filesystem. The root cause of the vulnerability stems from the direct handling of the user-supplied req.body.dir parameter, which is passed straight to the res.sendFile() function without any input sanitization, validation, or path normalization. Consequently, adversaries can leverage directory traversal sequences such as dot-dot-slash (../) or absolute paths to bypass intended application boundaries and access sensitive system files. The impact of this security deficiency is severe, as it exposes critical system configuration files, source code, and potentially sensitive user data to unauthorized remote actors over the network. Exploitation requires no prior authentication, specific privileges, or complex interaction, making it a high-risk entry point for network-based attackers. Defensive remediation requires implementing strict input sanitization, utilizing path normalization functions, and enforcing a restricted base directory whitelist before invoking file-serving APIs.",
  "technicalDetails": "The vulnerability is classified as a path traversal flaw affecting all versions of the mustafaakin/cast-localvideo product. The vulnerable component resides in the app.js file, specifically within the request handler logic located at lines 151-153. In this segment of the application, the server receives incoming HTTP requests containing a user-controlled parameter designated as req.body.dir. The core architectural defect is the absence of input sanitization, validation, or canonicalization checks on this parameter prior to its utilization in file system operations. Specifically, the application passes the raw, untrusted req.body.dir value directly into the Express.js res.sendFile() function. Because res.sendFile() interprets file paths relative to the root or accepts absolute filesystem paths depending on the input formatting, the lack of programmatic constraints allows external inputs to escape the intended web root directory.\nThe attack flow proceeds as follows: An unauthenticated remote attacker crafts an HTTP request targeting the vulnerable endpoint managed by app.js. Within the request body, the attacker populates the req.body.dir parameter with directory traversal sequences, such as multiple occurrences of '../', or specifies explicit absolute paths pointing to sensitive system resources (e.g., /etc/passwd or application configuration files). Upon receiving the request, the server reads the unsanitized parameter and feeds it directly into res.sendFile(). Because the framework lacks boundary enforcement, the operating system resolves the traversed path outside the designated application directory. The server subsequently reads the target file from the filesystem and returns its contents directly within the HTTP response body to the remote client. The post-exploitation impact includes the unauthorized disclosure of sensitive operating system files, application credentials, internal source code, and other confidential data accessible to the user context under which the Node.js process is executing. No authentication or elevated privileges are required to initiate this attack, and the network exposure vector is fully remote."
}