Streamlink is a command‑line video streamer that fetches content by following HTTP(S) URLs. Before version 8.6.0, its HTTPSession component allowed HTTP or HTTPS responses that contained a redirect to a file:// URL to be followed without validation. The session then opened and returned the contents of the local file referenced by the redirect. This behavior exposes arbitrary local files on the host running Streamlink, allowing a remote media source to exfiltrate data that the user could otherwise not access. The vulnerability corresponds to CWE‑73, an external control of file name or path.

All installations of Streamlink older than 8.6.0 are affected. The flaw exists in the core HTTPSession logic which processes every request, not just the initial stream URL. Users running any of those versions on any platform could be exposed if a media source they contact provides the redirect. The fix was included in release 8.6.0.

The CVSS score of 6.5 indicates a moderate severity. Exploitation requires only that a remote media provider send a malicious redirect; no elevated privileges or authentication are needed on the host. The EPSS score is not available, so the likelihood of exploitation is uncertain. Because the issue is not listed in the CISA KEV catalog, it has not been reported as a “known exploited vulnerability” in that database. Nevertheless, the vulnerability can leak any file readable by the Streamlink process, making it a concern for systems that handle sensitive data.