Approved changes feed: RSS · Atom
cpe:2.3:a:streama:streama:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Streama (b17e4f23-6cca-575e-97d7-61eee80ace72) |
|---|---|
| Product | Streama (75d909e0-c989-597c-b4f8-efdbe78a6a1b) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-34452 |
vulnerable | 2026-06-08 07:20:59.609135 |
Streama Subtitle Download Path Traversal and SSRF Leading to Arbitrary File Write
Streama versions 1.10.0 through 1.10.5 and prior to commit b7c8767 contain a combination of path traversal and server-side request forgery (SSRF) vulnerabilities in that allow an authenticated attacker to write arbitrary files to the server filesystem. The issue exists in the subtitle download functionality, where user-controlled parameters are used to fetch remote content and construct file paths without proper validation. By supplying a crafted subtitle download URL and a path traversal sequence in the file name, an attacker can write files to arbitrary locations on the server, potentially leading to remote code execution.
Published: 2025-12-18T21:30:22.441Z
Updated: 2026-07-14T22:26:00.580Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.