CVE-2026-77385

MediumCVSS 4.3

Published: 18/09/2026(UTC)Updated: 23/09/2026(UTC)Translated: 19/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

25th percentile - higher than 25% of all known CVEs

Summary

In Kyoo media server prior to 5.1.0, a registered user with the core.play permission could supply a base64-encoded filesystem path to the transcoder. Path handling only checked the Settings.SafePath prefix and did not verify a Kyoo catalog record, allowing retrieval of hidden, temporary, or uncataloged files under the media directory when the path was known or guessed.

Risk Assessment

An authenticated user can access files outside the Kyoo catalog, potentially leaking operational or confidential data. The risk is limited to known or guessed paths.

Recommendation

Upgrade Kyoo to version 5.1.0 or later, which verifies a catalog record before serving the path.

Other vulnerabilities in Kyoo

CVE-2026-77386Medium
Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, an unauthenticated attacker could initiate the OIDC login flow with an attacker-controlled redirectUrl. The login handling in auth/oidc.go stored that URL with the opaque login state, and /auth/oidc/logged/{provider} appended the provider, token, and error values before redirecting the victim's browser without validating the destination. Because the one-use token was not bound to the browser session that initiated login, an attacker who induced a victim to complete OIDC authentication could capture the token at the attacker-controlled destination and exchange it through /auth/oidc/callback/{provider} for the victim's Kyoo session. This issue is fixed in version 5.1.0.

Original NVD description (English source)

Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, a registered user with the core.play permission could supply a base64-encoded filesystem path to the transcoder. The path handling in transcoder/src/api/path.go cleaned the value and checked only that it began with Settings.SafePath before getHash processed it, while transcoder/src/api/streams.go served the accepted path without verifying a Kyoo catalog record. This missing catalog-level authorization allowed the user to retrieve hidden, temporary, operational, or other uncataloged files beneath the media directory when the path was known or guessed. This vulnerability is fixed in 5.1.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS