Streamlink, a command‑line utility that forwards video streams from many services to a player, has a flaw that allows a remote attacker to cause the client to read arbitrary local files. The HLS and DASH parsers fail to validate the URI scheme of segment entries; a malicious playlist or manifest can embed a file:///path as a segment, leading Streamlink to open and stream that local file. This results in a local file read with the permissions of the user running Streamlink, exposing potentially confidential data. The vulnerability is a classic instance of CWE‑22, where an attacker controls input that bypasses intended security checks on filesystem paths.

All versions of Streamlink prior to 8.4.0 are affected, regardless of the operating system. The issue is product‑wide and applies to the standard command‑line client, not just specific distribution packages.

The flaw scores a CVSS of 6.5 and currently has no EPSS value; it is not listed in the CISA KEV catalog. An attacker who can supply a crafted .m3u8 or .mpd via a remote HTTP or HTTPS source can trigger the vulnerability. The attack requires the target to run Streamlink and fetch the malicious playlist, after which the local file is read and streamed outward. Because the read occurs locally, the attack presents a moderate risk level but can expose sensitive files depending on user privileges.