Bug 2569072

Summary: CVE-2026-121629 gstreamer1-plugins-good: gst-plugins-good: Local file disclosure via unvalidated file:// URIs in adaptivedemux2 manifest handling [fedora-rawhide]
Product: [Fedora] Fedora Reporter: lcelant
Component: gstreamer1-plugins-goodAssignee: Wim Taymans <wtaymans>
Status: NEW --- QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: high    
Version: rawhideCC: dominik, gwync, multimedia-sig, negativo17, wtaymans
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["8a1020fc-6801-45d0-b7ce-b124d749eb13"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2565965    

Description lcelant 2026-11-09 11:04:37 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

GStreamer's adaptivedemux2 plugin (gst-plugins-good subproject) provides the hlsdemux2, dashdemux2, and mssdemux2 elements for adaptive-bitrate streaming. The download helper function downloadhelper_submit_request() in ext/adaptivedemux2/downloadhelper.c (line 1153) routes URIs starting with 'file://' to GLib's GFile async I/O path, enabling local file access. This file:// support was introduced in GStreamer 1.26.0 (commit f2a18ab277, 2024-07-30).

The root cause is that URIs derived from untrusted manifest content — DASH BaseURL elements, xlink:href attributes (actuate='onLoad'), SegmentURL media/index attributes, and HLS EXT-X-KEY 'URI' values — are resolved and passed directly to downloadhelper_submit_request() without any scheme restriction. The only scheme validation in the codebase (gstadaptivedemux.c lines 1080-1083) applies exclusively to the manifest's own URI, not to URIs extracted from the manifest's content. An attacker who controls the manifest (or can inject content into an HTTP manifest response) can embed file:// URIs, causing the application to open and read arbitrary local files. File bytes are placed into GStreamer buffers and can be forwarded downstream (written to disk, relayed over network, or inspected via error-code oracles).

Affected: gst-plugins-good >= 1.26.0 (file:// read path). URIs were never scheme-checked since adaptivedemux2 was added in 1.22.0, but the libsoup download path prior to 1.26.0 rejected file:// URIs natively, so practical exploitation requires >= 1.26.0.

Fixed in: 1.28.9 (unreleased as of 2026-10-30); upstream security MR !135 (private/embargoed).

Reported by: Sebastian Dröge (GStreamer maintainer); ticket PSIRTSUPT-29599; upstream advisory GStreamer-SA-2026-0097.