Root-Directory Confinement Bypass Vulnerability in ZLMediaKit

CVE-2026-81028

What is CVE-2026-81028?

The downloadFile API in ZLMediaKit has a vulnerability stemming from inadequate directory boundary checks. The API restricts access to a set of configured root directories but fails to enforce proper separation between these paths. By utilizing a prefix-based check, a malicious actor could potentially access files from sibling directories that share the same initial configuration string, exploiting the lack of trailing separators in path verification. Though access requires an API secret, the flaw allows reading of files outside the intended directories, posing a serious risk, particularly since the server often operates with root privileges.

References