GStreamer's adaptivedemux2 plugin (gst-plugins-good subproject) provides the hlsdemux2, dashdemux2, and mssdemux2 elements for adaptive-bitrate streaming. The download helper function downloadhelper_submit_request() in ext/adaptivedemux2/downloadhelper.c (line 1153) routes URIs starting with 'file://' to GLib's GFile async I/O path, enabling local file access. This file:// support was introduced in GStreamer 1.26.0 (commit f2a18ab277, 2024-07-30).

The root cause is that URIs derived from untrusted manifest content — DASH BaseURL elements, xlink:href attributes (actuate='onLoad'), SegmentURL media/index attributes, and HLS EXT-X-KEY 'URI' values — are resolved and passed directly to downloadhelper_submit_request() without any scheme restriction. The only scheme validation in the codebase (gstadaptivedemux.c lines 1080-1083) applies exclusively to the manifest's own URI, not to URIs extracted from the manifest's content. An attacker who controls the manifest (or can inject content into an HTTP manifest response) can embed file:// URIs, causing the application to open and read arbitrary local files. File bytes are placed into GStreamer buffers and can be forwarded downstream (written to disk, relayed over network, or inspected via error-code oracles).

Affected: gst-plugins-good >= 1.26.0 (file:// read path). URIs were never scheme-checked since adaptivedemux2 was added in 1.22.0, but the libsoup download path prior to 1.26.0 rejected file:// URIs natively, so practical exploitation requires >= 1.26.0.

Fixed in: 1.28.9 (unreleased as of 2026-10-30); upstream security MR !135 (private/embargoed).

Reported by: Sebastian Dröge (GStreamer maintainer); ticket PSIRTSUPT-29599; upstream advisory GStreamer-SA-2026-0097.