CyberRota Analysis
AI-GeneratedA path traversal vulnerability in mustafaakin/cast-localvideo allows unauthenticated remote attackers to read arbitrary files from the server due to unsanitized user input in the app.js handler. This could lead to exposure of sensitive system files, posing a significant risk to data confidentiality. Organizations using this application should prioritize patching or mitigating this vulnerability to protect against potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A path traversal vulnerability in mustafaakin/cast-localvideo (all versions) allows an unauthenticated remote attacker to read arbitrary files from the server. The app.js handler at lines 151-153 passes the user-supplied req.body.dir parameter directly to res.sendFile() without sanitization, enabling directory traversal via absolute paths or ../ sequences to read sensitive system files.