Bug 2565965 (CVE-2026-121629)

Summary: CVE-2026-121629 gst-plugins-good: gst-plugins-good: Local file disclosure via unvalidated file:// URIs in adaptivedemux2 manifest handling
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: rhel-process-autobot, security-response-team, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in GStreamer's adaptive streaming demuxers (HLS, DASH, MSS). When processing a media playlist or manifest, URIs referenced in the manifest content are fetched without restricting which URI schemes are permitted. An attacker who controls a manifest URL, or who can inject content into an HTTP manifest response, can include file:// URIs pointing to arbitrary local files, causing the affected application to read and process those files. In automated or server-side deployments such as media recorders, proxies, and downloaders, this can lead to disclosure of sensitive local files. Existence of files can also be inferred through differing error responses even when content is not directly observable.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2569062, 2569064, 2569066, 2569068, 2569070, 2569072    
Bug Blocks:    

Description OSIDB Bzimport 2026-11-03 17:01:03 UTC 
GStreamer's adaptivedemux2 plugin (gst-plugins-good subproject) provides the hlsdemux2, dashdemux2, and mssdemux2 elements for adaptive-bitrate streaming. The download helper function downloadhelper_submit_request() in ext/adaptivedemux2/downloadhelper.c (line 1153) routes URIs starting with 'file://' to GLib's GFile async I/O path, enabling local file access. This file:// support was introduced in GStreamer 1.26.0 (commit f2a18ab277, 2024-07-30).

The root cause is that URIs derived from untrusted manifest content — DASH BaseURL elements, xlink:href attributes (actuate='onLoad'), SegmentURL media/index attributes, and HLS EXT-X-KEY 'URI' values — are resolved and passed directly to downloadhelper_submit_request() without any scheme restriction. The only scheme validation in the codebase (gstadaptivedemux.c lines 1080-1083) applies exclusively to the manifest's own URI, not to URIs extracted from the manifest's content. An attacker who controls the manifest (or can inject content into an HTTP manifest response) can embed file:// URIs, causing the application to open and read arbitrary local files. File bytes are placed into GStreamer buffers and can be forwarded downstream (written to disk, relayed over network, or inspected via error-code oracles).

Affected: gst-plugins-good >= 1.26.0 (file:// read path). URIs were never scheme-checked since adaptivedemux2 was added in 1.22.0, but the libsoup download path prior to 1.26.0 rejected file:// URIs natively, so practical exploitation requires >= 1.26.0.

Fixed in: 1.28.9 (unreleased as of 2026-10-30); upstream security MR !135 (private/embargoed).

Reported by: Sebastian Dröge (GStreamer maintainer); ticket PSIRTSUPT-29599; upstream advisory GStreamer-SA-2026-0097.