CVE-2026-92164 streamlink CVE debrief

Who should care

Streamlink users and administrators should assess exposure and update to version 8.6.0 or later. Defenders should review HTTPSession usage, verify Streamlink configuration, and monitor for potential local file exposure. Security teams should prioritize updating Streamlink to prevent potential local file exposure through HTTPSession redirects.

Why it matters

CVE-2026-92164 allows remote servers to return redirects to local file URLs, potentially exposing local file contents through Streamlink's HTTPSession. Defenders should update to version 8.6.0 or later and review HTTPSession usage.

• Potential local file exposure through Streamlink
• Need to verify and restrict usage of HTTPSession
• Possible data leakage through local file contents

Technical summary

Streamlink's HTTPSession mounts a FileAdapter for the file scheme and inherits redirect handling from requests.Session without rejecting cross-protocol redirects. This allows a remote server to return a redirect to a local file URL and causes HTTPSession to read the local file and return its contents to the response consumer. The flaw applies to every request made through HTTPSession, and a segment fetch can place the local file contents into stream output. This issue is fixed in version 8.6.0 by properly handling redirects and rejecting cross-protocol redirects.

Defensive priority

Medium priority for Streamlink users to update to version 8.6.0

Recommended defensive actions

• Update Streamlink to version 8.6.0 or later
• Review and restrict usage of HTTPSession in Streamlink
• Monitor for potential local file exposure
• Verify Streamlink usage and configuration
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but limited information on affected versions and exploitation. Defenders should verify Streamlink usage, review HTTPSession configuration, and monitor for potential local file exposure. The vulnerability allows remote servers to return redirects to local file URLs, potentially exposing local file contents through Streamlink's HTTPSession.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.