CVE-2025-66203
🔴 Łataj teraz
Luka RCE w StreamVault umożliwia zdalne wykonanie kodu przez nieprawidłową walidację argumentów.
CVSS
9.9
EPSS
0.8%
Exploit
poc
Vendor
lemon8866
Opis źródłowy (NVD)
StreamVault is a video download integration solution. Prior to version 251126, a Remote Code Execution (RCE) vulnerability exists in the stream-vault application (SpiritApplication). The application allows administrators to configure yt-dlp arguments via the /admin/api/saveConfig endpoint without sufficient validation. These arguments are stored globally and subsequently used in YtDlpUtil.java when constructing the command line to execute yt-dlp. This issue has been patched in version 251126.
exploit rce
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 9.9 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 0.8% |
| Opublikowano (NVD) | 2025-12-27 00:15:41 UTC |
| Ostatnia modyfikacja (NVD) | 2026-10-05 19:10:00 UTC |
Referencje
- https://github.com/lemon8866/StreamVault/releases/tag/251226 ([email protected]) [Product, Release Notes]
- https://github.com/lemon8866/StreamVault/security/advisories/GHSA-c747-q388-3v6m ([email protected]) [Exploit, Vendor Advisory]