CVE-2026-72571 is a path traversal vulnerability in the mustafaakin cast-localvideo application affecting all versions. The vulnerability occurs because the app.js handler at lines 151-153 uses the user-supplied req.body.dir parameter directly in res.sendFile() without any input validation or sanitization. This allows an unauthenticated remote attacker to craft requests with directory traversal sequences (e.g., ../) or absolute paths to read arbitrary files on the server filesystem. The CVSS 3.1 score is 7.5 (high severity) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact.

An unauthenticated remote attacker can exploit this vulnerability to read arbitrary files on the server hosting cast-localvideo. This can lead to disclosure of sensitive information such as configuration files, credentials, or other critical data. There is no indication of integrity or availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting access to the affected service, implementing network-level controls to limit exposure, or applying custom input validation to sanitize the req.body.dir parameter to prevent directory traversal sequences.