Vulnerability · Published Dec 18, 2025 · Assigned by VulnCheck

CVE-2025-34452Streama Subtitle Download Path Traversal and SSRF Leading to Arbitrary File Write

High 8.7

In plain English

A high-severity path traversal in Streama from Streama. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 5.4% (higher than 93% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)5.4%top 7.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Streama versions 1.10.0 through 1.10.5 and prior to commit b7c8767 contain a combination of path traversal and server-side request forgery (SSRF) vulnerabilities in that allow an authenticated attacker to write arbitrary files to the server filesystem. The issue exists in the subtitle download functionality, where user-controlled parameters are used to fetch remote content and construct file paths without proper validation. By supplying a crafted subtitle download URL and a path traversal sequence in the file name, an attacker can write files to arbitrary locations on the server, potentially leading to remote code execution.

Affected products (as reported)

Vendor	Product	Versions
Streama	Streama	1.10.0 – through 1.10.5

Weakness: CWE-22, CWE-918 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N

References

https://github.com/streamaserver/streama/commit/b7c8767 patch
https://chocapikk.com/posts/2025/streama-path-traversal-ssrf/ technical-description, exploit
https://www.vulncheck.com/advisories/streama-subtitle-download-path-traversal-and-ssrf-leading-to-arbitrary-file-write third-party-advisory