CVE-2025-66203

StreamVault is a video download integration solution. Prior to version 251126, a Remote Code Execution RCE vulnerability exists in the stream-vault application SpiritApplication. The application allows administrators to configure yt-dlp arguments via the /admin/api/saveConfig endpoint without...

CVE-2025-66203

CVE-2025-66203 affects StreamVault’s SpiritApplication. Prior to version 251126, an RCE exists because administrators can configure yt-dlp arguments via /admin/api/saveConfig without sufficient validation; these arguments are stored globally and later used by YtDlpUtil.java to construct the yt-dl...