Argument Injection Vulnerability in Seanime Product by 5rahim

CVE-2026-111728

What is CVE-2026-111728?

Seanime versions 3.7.0 through 3.10.3 are affected by an argument injection vulnerability due to improper authorization processes. This flaw allows unauthenticated LAN or Tailnet clients to exploit the media streaming functionalities by manipulating the transcodeHwAccel settings. By injecting arbitrary values into the decodeFlags and encodeFlags via the transcodeHwAccelCustomSettings field, attackers can modify the ffmpeg argument vector, leading to potential execution of malicious commands. Through this vulnerability, attackers can trigger unauthorized file writes, file truncations, local file reads, and data exfiltration, compromising the host environment where Seanime is running.

References