vciy
vciy-2026-0008 · mhdzumair/mediaflow-proxy · CWE-918

Incomplete fix for CVE-2026-100391: missing internal-address validation in mediaflow-proxy HLS, DASH, and transcode routes

Commit 99f4af1153087d335c3e127591d46e8355bc8023 (PR #286, addressing issue #284 / CVE-2026-100391) added _check_not_internal_address() to proxy_forward_endpoint (/proxy/forward) and proxy_stream_endpoint (/proxy/stream), but omitted _check_not_internal_address() from the sibling /proxy/hls/*, /proxy/mpd/*, and /proxy/transcode/* route handlers in mediaflow_proxy/routes/proxy.py.

Receipt & provenance · vciy-2026-0008
Advisory ID
vciy-2026-0008canonical vciy advisory identifier
Upstream project
mhdzumair/mediaflow-proxyPython (PyPI)
Affected versions
mediaflow-proxy <= 2.4.9verified on upstream default branch
Weakness class
CWE-918Server-Side Request Forgery (SSRF)
Related CVE records
CVE-2026-100391upstream fix commit inspected
Upstream tracking
mhdzumair/mediaflow-proxy#299reported 2026-10-22 · Published (upstream issue open)
Credit
Jonathan Corners (@JCorners68), Voxell, Inc. (https://vciy.com)discovered and reported
Record CVE-2026-100391 as mitigated Open CVE-2026-100391 evidence page All vciy advisories
01

Root cause and sibling analysis.

1. GET /proxy/hls/manifest.m3u8 -> hls_manifest_proxy (mediaflow_proxy/routes/proxy.py:164-203): Accepts a caller-supplied destination URL via the d query parameter and passes it to handle_hls_stream_proxy (mediaflow_proxy/handlers.py:139, 205, 231) without calling _check_not_internal_address(), streaming non-m3u8 upstream responses directly back to the caller.

2. GET /proxy/hls/segment.{ext} -> hls_segment_proxy (mediaflow_proxy/routes/proxy.py:245-325): Fetches segment_url (alias d) via hls_prebuffer.get_or_download or handle_stream_request and returns the raw response body without calling _check_not_internal_address().

3. Sibling MPD and transcode routes (transcode_hls_playlist, transcode_hls_init, transcode_hls_segment, mpd_manifest_proxy, playlist_endpoint, segment_endpoint, and init_endpoint in mediaflow_proxy/routes/proxy.py) likewise omit _check_not_internal_address().

02

Remediation.

Call await _check_not_internal_address(...) on the destination URL across all route handlers in mediaflow_proxy/routes/proxy.py, or enforce the check centrally inside the outbound HTTP request helper.

Suggested defensive diff 
--- a/mediaflow_proxy/routes/proxy.py
+++ b/mediaflow_proxy/routes/proxy.py
@@ -177,6 +177,7 @@ async def hls_manifest_proxy(
     # Sanitize destination URL to fix common encoding issues
     hls_params.destination = sanitize_url(hls_params.destination)
+    await _check_not_internal_address(hls_params.destination)
 
     return await handle_hls_stream_proxy(request, hls_params, proxy_headers)
 
@@ -248,6 +249,7 @@ async def hls_segment_proxy(
     # Sanitize segment URL to fix common encoding issues
     original_url = segment_url
     segment_url = sanitize_url(segment_url)
+    await _check_not_internal_address(segment_url)