FFmpeg 5.0 through 9.0.2 includes a path traversal flaw in the IMF demuxer that allows an attacker to read files outside the intended package. The flaw arises from unvalidated ASSETMAP Path elements, permitting the use of '..' or absolute paths in a crafted IMF package. Exploitation can result in the attacker probing the existence and size of arbitrary files on the host or triggering server‑side requests based on the package contents, thereby leaking sensitive data and potentially enabling further attacks.

Systems running FFmpeg version 5.0 up to 9.0.2 are affected. The flaw is specific to the FFmpeg FFmpeg product and impacts any deployment that processes IMF files with a vulnerable version. No other FFmpeg releases outside this range are known to be vulnerable.

The CVSS score of 5.3 indicates a moderate severity. EPSS is not available, and the issue is not listed in CISA KEV, suggesting limited, if any, active exploitation. The attack vector requires an attacker to supply a malicious IMF package to a system that uses the IMF demuxer; therefore, the risk is higher in environments exposed to untrusted media ingestion or that automatically process IMF files. While no direct remote code execution is possible, the ability to read arbitrary files and influence server requests constitutes a notable security concern.