Streamlink: Prior to 8.6.0, HTTPSession mounts a FileAdapter for the file scheme and inherits redirect handling from requests.Session without rejecting… (CVE-2026-92164)

Streamlink is a CLI utility for piping video streams into a player. Before version 8.6.0, its HTTPSession component mounts a FileAdapter for the file scheme and inherits redirect handling from requests.Session without rejecting cross-protocol redirects. This means a remote server controlling an HTTP or HTTPS URL can respond with a redirect to a local file URL. As a result, HTTPSession reads the local file and returns its contents to the consumer. This bypasses direct file URL checks for HLS and DASH content because the manifest initially contains a network URL, and the scheme transition happens later during fetch handling. This vulnerability affects every request made through HTTPSession and can cause local file contents to be included in the stream output. The vulnerability is addressed in Streamlink version 8.6.0.

An attacker controlling a remote HTTP or HTTPS URL can cause Streamlink to read arbitrary local files by issuing a redirect to a file URL. This leads to disclosure of local file contents to the response consumer, potentially exposing sensitive information. The vulnerability affects all requests made through HTTPSession and can compromise confidentiality of local files. There is no indication of integrity or availability impact. The CVSS score is 6.5 (medium severity) reflecting network attack vector, low complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, no integrity or availability impact.

This vulnerability is fixed in Streamlink version 8.6.0. Users should upgrade to version 8.6.0 or later to remediate this issue. No other mitigations are indicated or required.