CVE-2026-72571 is a path traversal vulnerability (CWE-22) in the mustafaakin cast-localvideo application. The vulnerability exists because the app.js handler at lines 151-153 uses the user-supplied req.body.dir parameter directly in res.sendFile() without sanitization. This allows an unauthenticated remote attacker to exploit directory traversal via absolute paths or '../' sequences to read arbitrary files on the server. The vulnerability affects all versions of the product, with no vendor advisory or patch currently available.

An unauthenticated remote attacker can read arbitrary files on the affected server, potentially exposing sensitive system information. The vulnerability does not allow modification or denial of service but compromises confidentiality. The CVSS 3.1 base score is 7.5 (high), reflecting network attack vector, no privileges required, no user interaction, and high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting access to the affected service or implementing network-level controls to limit exposure. Avoid exposing the vulnerable endpoint to untrusted networks.