Skip to content
OpenAdvisories

Vendor

ZLMediaKit

2 known vulnerabilities.

Products

ZLMediaKit 2
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 4.9
    CVE-2026-81028

    ZLMediaKit downloadFile Root-Directory Confinement Bypass via Prefix Collision

    ZLMediaKit confines the downloadFile API to a configured set of root directories with a prefix comparison that does not account for directory boundaries. The configuration loader in server/WebApi.cpp builds each root with File::absolutePath("", item, true); b…

    ZLMediaKit ZLMediaKit