CVE-2026-77385

MEDIUM 4.3

Kyoo: Transcoder serves uncataloged files from the media directory

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, a registered user with the core.play permission could supply a base64-encoded filesystem path to the transcoder. The path handling in transcoder/src/api/path.go cleaned the value and checked only that it began with Settings.SafePath before getHash processed it, while transcoder/src/api/streams.go served the accepted path without verifying a Kyoo catalog record. This missing catalog-level authorization allowed the user to retrieve hidden, temporary, operational, or other uncataloged files beneath the media directory when the path was known or guessed. This vulnerability is fixed in 5.1.0.

CWE	CWE-639 CWE-862
Vendor	zoriya
Product	kyoo
Published	Sep 18, 2026
Last Updated	Sep 18, 2026

Stay Ahead of the Next One

Get instant alerts for zoriya kyoo

Be the first to know when new medium vulnerabilities affecting zoriya kyoo are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

zoriya / Kyoo

< 5.1.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/zoriya/Kyoo/security/advisories/GHSA-fc8v-vr3q-hc46 github.com: https://github.com/zoriya/Kyoo/pull/1577 github.com: https://github.com/zoriya/Kyoo/commit/c542adb5dc6d681e6491b28b5ac618c35c446d91 github.com: https://github.com/zoriya/Kyoo/releases/tag/v5.1.0