# CVE-2026-121629: Gst-plugins-good: gst-plugins-good: local file disclosure via unvalidated file:// uris in adaptivedemux2 manifest handling

Status: published. Published: 2026-11-09. Updated: 2026-11-09.

A flaw was found in GStreamer's adaptive streaming demuxers (HLS, DASH, MSS). When processing a media playlist or manifest, URIs referenced in the manifest content are fetched without restricting which URI schemes are permitted. An attacker who controls a manifest URL, or who can inject content into an HTTP manifest response, can include file:// URIs pointing to arbitrary local files, causing the affected application to read and process those files. In automated or server-side deployments such as media recorders, proxies, and downloaders, this can lead to disclosure of sensitive local files. Existence of files can also be inferred through differing error responses even when content is not directly observable.

## Remediation

- workaround: Avoid opening HLS, DASH, or MSS manifests from untrusted network sources. Run GStreamer-based applications with minimal filesystem access using Linux namespaces or containers, restricting the process to only the directories it legitimately requires. Where feasible, use network controls to limit which manifest hosts the application may contact. These measures reduce risk but do not remove the vulnerability. (source: CNA: redhat)

## Affected products and versions

- Red Hat / Red Hat Enterprise Linux 10 (gstreamer1-plugins-good): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 6 (gstreamer-plugins-good): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 7 (gstreamer1-plugins-good): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 7 (gstreamer-plugins-good): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8 (gstreamer1-plugins-good): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9 (gstreamer1-plugins-good): Version range not reported. Source: CNA: redhat

## Severity and prioritization

- CVSS 3.1: 7.5 (high); CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N; source: CNA: redhat

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-73

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://access.redhat.com/security/cve/CVE-2026-121629 (CNA: redhat; vdb-entry, x_refsource_REDHAT)

- https://bugzilla.redhat.com/show_bug.cgi?id=2565965 (CNA: redhat; issue-tracking, x_refsource_REDHAT)

- https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5380 (CNA: redhat)

- https://gstreamer.freedesktop.org/security/sa-2026-0097.html (CNA: redhat)

## Provenance

- CNA: redhat: https://www.cve.org/CVERecord?id=CVE-2026-121629; retrieved 2026-11-09; source updated 2026-11-09

Revision: b8c9581706a12faa28da55dc99a38b495d7826199a9939d973d97e59c01303b8

Canonical: https://y2.dev/cve/CVE-2026-121629

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.