CVE-2026-77385

Kyoo , a self-hosted media server for movies, series, and anime, is affected by a missing catalog-level authorization in its transcoder component prior to version 5.1.0 . Specifically, transcoder/src/api/path.go validated only that a base64-encoded filesystem path began with Settings.SafePath, wh...