Vulnerability · Published Oct 16, 2026 · Assigned by VulnCheck

CVE-2026-111728Seanime v3.10.3 Argument Injection via TranscodeHwAccelCustomSettings

Medium 5.4

In plain English

A medium-severity argument injection in Seanime from 5rahim. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.3%top 82.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Seanime v3.7.0 to v3.10.3 contains an argument injection vulnerability reachable through improper authorization, allowing unauthenticated LAN or Tailnet clients to bypass the privileged mediastream settings guard by setting transcodeHwAccel to custom and supplying attacker-controlled decodeFlags and encodeFlags via the transcodeHwAccelCustomSettings field, which are appended verbatim to the ffmpeg argument vector. Attackers can trigger execution via the mediastream request and HLS playlist endpoints to achieve arbitrary file write and file truncation on the host as the user running seanime, with the injected input options also enabling potential arbitrary local file read and outbound data exfiltration through ffmpeg's protocol handlers.

Affected products (as reported)

Vendor	Product	Versions
5rahim	Seanime	3.7.0 – before 3.10.4

Weakness: CWE-88 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References

https://github.com/5rahim/seanime/commit/d7b13706da236473f33163b1222eb09587e93388 patch
https://github.com/5rahim/seanime product
VulnCheck Advisory: Seanime v3.10.3 Argument Injection via TranscodeHwAccelCustomSettings third-party-advisory