The vulnerability lies in ZLMediaKit’s downloadFile API, which incorrectly resolves root directories. The code loads root paths using a helper that omits a trailing separator when the relative path is empty, and the API accepts a file path if it starts with the root string. A directory whose name merely begins with the configured root string can therefore be accessed, allowing an attacker to download any file outside the intended sandbox. The flaw is a classic Directory Traversal (CWE‑22) that enables arbitrary file disclosure. The API is protected by an API secret, so the attacker already needs that credential; once they have it, they can read any file that the server process can access, which is especially dangerous when the server runs as root, as noted in the reference container.

The affected product is ZLMediaKit across all releases that contain the current downloadFile implementation. No version ranges are explicitly listed, so any installed instance that has not yet applied an update where the bug is fixed is vulnerable. Administrators should treat all ZLMediaKit deployments as impacted until they confirm the code change or a patch has been applied.

The CVSS score of 6.9 indicates moderate severity. Because the EPSS score is not available and the vulnerability has not been reported in the CISA KEV catalog, there is no evidence of active exploitation in the wild. However, the flaw requires only the API secret and the server’s permissions; if the secret is compromised or weak, an attacker can read sensitive files. The lack of a disallowed double‑dot check further widens the attack surface. In environments where the server runs as root, the potential impact is higher, turning a data exfiltration vector into a full system compromise if additional privileges are available.