CVE-2026-54150— next-video: Unauthenticated arbitrary file read via /api/video request handler
Quick assessment
Affected
muxinc next-video
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
是一个用于在 Next.js 应用中集成视频的库。在 2.8.1 之前，由 导出、通常挂载在 的 GET 端点接受一个未认证的 查询参数，而 中的 会将任何不带 或 前缀的值视为本地文件路径。 将该值通过 中的 传入 的 ，该函数会在路径末尾追加 JSON 后缀，并使用 读取文件，且未对路径进行规范化（canonicalization），也未验证该路径是否仍位于配置的视频资源目录内。因此，远程攻击者可以逃逸出预期的资源目录，读取应用进程可访问的 JSON 文件，包括：Next.js 服务器动作（server-act
Possible ATT&CK Techniques 1 AI
T1082 · System Information Discovery
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-54150
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
next-video: Unauthenticated arbitrary file read via /api/video request handler
Source: CVE Program / CVE List V5
Vulnerability Description
next-video is a library for adding video to Next.js applications. Prior to 2.8.1, the GET endpoint exported by next-video/request-handler and commonly mounted at /api/video accepts an unauthenticated url query parameter, while src/utils/utils.ts isRemote() treats any value without an HTTP or HTTPS prefix as a local path. src/request-handler.ts passes that value through src/assets.ts getAssetPath() to src/config.ts loadAsset(), which appends a JSON suffix and uses fs.readFile without canonicalizing the path or verifying that it remains inside the configured video folder. A remote attacker can therefore escape the intended asset directory and read JSON files accessible to the application process, including Next.js server-action encryption material, preview-mode keys, build manifests, route metadata, absolute paths, and application video asset identifiers. Applications that do not expose the runtime request handler are not affected through this route. This issue is fixed in version 2.8.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| muxinc | next-video | < 2.8.1 | - |
|
II. Public POCs for CVE-2026-54150
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-54150
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-54150 (1)
Vendor Advisories for CVE-2026-54150 (1)
Vendor Pages for CVE-2026-54150 (1)
-
🔗 Release v2.8.1 · muxinc/next-video · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same weakness: CWE-22
-
CVE-2026-82035
PyMuPDF 1.28.2 Path Traversal via extract_objects() Font Bra -
CVE-2026-18515
IBM i is Affected By Multiple Vulnerabilities in Navigator f -
CVE-2026-55832
Tract: Arbitrary file read via unsanitized ONNX external_dat -
CVE-2026-54178
backpack/crud: Arbitrary file deletion via attacker-controll -
CVE-2026-47256
OpenTelemetry: Path traversal in Sentry exporter via attacke
V. Comments for CVE-2026-54150
No comments yet