Streamvault
Approved changes feed: RSS · Atom
cpe:2.3:a:lemon8866:streamvault:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Lemon8866 (27a1a8e4-7b6c-588e-9b27-21965d0ff78e) |
|---|---|
| Product | Streamvault (7f81b2ec-878d-5ba6-b803-c6fc6bf14374) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/lemon8866/streamvault |
purl2cpe | 2026-07-28 16:40:53.666754 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-66203 |
vulnerable | 2026-06-08 07:39:21.489365 |
StreamVault is Vulnerable to Authenticated Remote Code Execution (RCE) via ytdlpargs Configuration Injection
CRITICAL (10)
StreamVault is a video download integration solution. Prior to version 251126, a Remote Code Execution (RCE) vulnerability exists in the stream-vault application (SpiritApplication). The application allows administrators to configure yt-dlp arguments via the /admin/api/saveConfig endpoint without sufficient validation. These arguments are stored globally and subsequently used in YtDlpUtil.java when constructing the command line to execute yt-dlp. This issue has been patched in version 251126.
Published: 2025-12-26T23:37:03.817Z
Updated: 2025-12-29T15:52:51.712Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-57799 |
vulnerable | 2026-06-08 07:33:16.148704 |
StreamVault can perform remote command execution
StreamVault is a multi-platform video parsing and downloading tool. Prior to version 250822, after logging into the StreamVault-system, an attacker can modify certain system parameters, construct malicious commands, execute command injection attacks against the system, and ultimately gain server privileges. Users of all versions of the StreamVault system to date who have not modified their background passwords or use weak passwords are at risk of having their systems taken over via remote command execution. This issue has been patched in version 250822.
Published: 2025-09-01T15:46:27.137Z
Updated: 2025-09-02T18:09:44.881Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.