CVE-2026-111728: Seanime 3.7.0 to before 3.10.4

Affected technology

Seanime · 3.7.0 to before 3.10.4
5rahim

Description’s affected range: v3.7.0 to v3.10.3

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Adjacent network · No privileges required · No user interaction required

What an attacker can do

Attackers can trigger execution via the mediastream request and HLS playlist endpoints to achieve arbitrary file write and file truncation on the host as the user running seanime, with the injected input options also enabling potential arbitrary local file read and outbound data exfiltration through ffmpeg's protocol handlers. Vendor/CNA’s CVSS 4.0 assessment (base score 5.3/10) rates confidentiality and integrity impact as low; availability impact as none.