CVE-2025-34452

Streama versions 1.10.0 through 1.10.5 and prior to commit b7c8767 contain a combination of path traversal and server-side request forgery (SSRF) vulnerabilities in that allow an authenticated attacker to write arbitrary files to the server filesystem. The issue exists in the subtitle download functionality, where user-controlled parameters are used to fetch remote content and construct file paths without proper validation. By supplying a crafted subtitle download URL and a path traversal sequence in the file name, an attacker can write files to arbitrary locations on the server, potentially leading to remote code execution.

CVSS

No CVSS.

References

Link	Resource
https://chocapikk.com/posts/2025/streama-path-traversal-ssrf/
https://github.com/streamaserver/streama/commit/b7c8767
https://www.vulncheck.com/advisories/streama-subtitle-download-path-traversal-and-ssrf-leading-to-arbitrary-file-write

Configurations

No configuration.

History

13 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de Streama 1.10.0 a 1.10.5 y anteriores al commit b7c8767 contienen una combinación de vulnerabilidades de salto de ruta y falsificación de petición del lado del servidor (SSRF) que permiten a un atacante autenticado escribir archivos arbitrarios en el sistema de archivos del servidor. El problema existe en la funcionalidad de descarga de subtítulos, donde se utilizan parámetros controlados por el usuario para obtener contenido remoto y construir rutas de archivo sin una validación adecuada. Al proporcionar una URL de descarga de subtítulos manipulada y una secuencia de salto de ruta en el nombre del archivo, un atacante puede escribir archivos en ubicaciones arbitrarias en el servidor, lo que podría conducir a la ejecución remota de código.

Information

Published : 2025-12-18 22:15

Updated : 2026-10-13 11:10

NVD link : CVE-2025-34452

Mitre link : CVE-2025-34452

CVE.ORG link : CVE-2025-34452

JSON object : View

Products Affected

No product.

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2025-34452", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-34452", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-12-18T21:59:31.026501Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/streamaserver/streama", "vendor": "Streama", "product": "Streama", "versions": [{"status": "affected", "version": "1.10.0", "versionType": "semver", "lessThanOrEqual": "1.10.5"}, {"status": "unaffected", "version": "b7c8767d25634e159f9e8844230465f29c16efc8", "versionType": "git"}], "packageURL": "pkg:github/streamaserver/streama", "defaultStatus": "unaffected"}]}], "published": "2025-12-18T22:15:56.473", "references": [{"url": "https://chocapikk.com/posts/2025/streama-path-traversal-ssrf/", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/streamaserver/streama/commit/b7c8767", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/streama-subtitle-download-path-traversal-and-ssrf-leading-to-arbitrary-file-write", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Streama versions 1.10.0 through 1.10.5 and prior to commit b7c8767 contain a\u00a0combination of path traversal and server-side request forgery (SSRF) vulnerabilities in that allow an authenticated attacker to write arbitrary files to the server filesystem. The issue exists in the subtitle download functionality, where user-controlled parameters are used to fetch remote content and construct file paths without proper validation. By supplying a crafted subtitle download URL and a path traversal sequence in the file name, an attacker can write files to arbitrary locations on the server, potentially leading to remote code execution."}, {"lang": "es", "value": "Las versiones de Streama 1.10.0 a 1.10.5 y anteriores al commit b7c8767 contienen una combinaci\u00f3n de vulnerabilidades de salto de ruta y falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF) que permiten a un atacante autenticado escribir archivos arbitrarios en el sistema de archivos del servidor. El problema existe en la funcionalidad de descarga de subt\u00edtulos, donde se utilizan par\u00e1metros controlados por el usuario para obtener contenido remoto y construir rutas de archivo sin una validaci\u00f3n adecuada. Al proporcionar una URL de descarga de subt\u00edtulos manipulada y una secuencia de salto de ruta en el nombre del archivo, un atacante puede escribir archivos en ubicaciones arbitrarias en el servidor, lo que podr\u00eda conducir a la ejecuci\u00f3n remota de c\u00f3digo."}], "lastModified": "2026-10-13T11:10:00.203", "sourceIdentifier": "disclosure@vulncheck.com"}