CVE-2026-28427

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2026-28427 is a path traversal vulnerability (CWE-22, CWE-24) affecting OpenDeck, a Linux-based software application for controlling Elgato Stream Deck devices. In versions prior to 2.8.1, the service listening on TCP port 57118, which serves static files for installed plugins, fails to properly sanitize path components in HTTP requests. This allows attackers to include directory traversal sequences such as "../" in the request path, enabling access to files outside the intended plugin directory that are readable by the OpenDeck process. The vulnerability has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact with no requirements for authentication or user interaction.

Any unauthenticated attacker with network access to the vulnerable OpenDeck service on port 57118 can exploit this issue by crafting an HTTP request with traversal sequences to read arbitrary files accessible to the OpenDeck process, such as configuration files, credentials, or other sensitive data on the host system. Exploitation requires no privileges and can be performed remotely over the network with low complexity, potentially exposing system information depending on the permissions of the OpenDeck service user.

The vulnerability is addressed in OpenDeck version 2.8.1, as detailed in the project's GitHub security advisory (GHSA-4974-g27q-h5m8) and the corresponding fix commit (488a52050017e95a72ba448226ac5e19a20dd9ed). Security practitioners should recommend immediate upgrades to 2.8.1 or later, restrict network access to port 57118 where possible, and monitor for anomalous requests to the service.