Threats tagged 'ghsa-437x-xcvf-w98c'

FFmpeg versions 5.0 through 9.0.2 have a path traversal vulnerability in the IMF demuxer. This flaw allows attackers to open files outside the intended package by supplying crafted IMF packages with unvalidated ASSETMAP Path elements containing '..' or absolute paths. Exploitation can lead to probing local MXF files for existence and size or triggering server-side requests.