The flaw is an argument injection vulnerability in Seanime v3.7.0–v3.10.3 caused by improper authorization controls. Attackers can supply arbitrary ffmpeg command-line flags via the transcodeHwAccelCustomSettings field when the transcodeHwAccel option is set to custom. The injected decodeFlags and encodeFlags are appended verbatim to the ffmpeg argument vector, enabling the host to write or truncate files and possibly read local files or exfiltrate data through ffmpeg's protocol handlers, effectively giving the attacker remote code execution capabilities as the process user.

The vulnerability affects the 5rahim:Seanime application in versions 3.7.0 through 3.10.3 inclusive. These releases run in any environment where Seanime is deployed, including local networks and Tailnet connections.

The CVSS score of 5.3 classifies the flaw as medium severity. Because no EPSS data is available, the current likelihood of exploitation cannot be quantified, and the vulnerability is not listed in CISA KEV. However, since the flaw is reachable from unauthenticated LAN or Tailnet clients and can lead to arbitrary file write and potential data exfiltration, an attacker with network access to the host can compromise the system. The access requires administrative privileges on the host to fully exploit the file write, but not necessarily root; it merely runs under the same user as the Seanime process.