CVE-2022-26505

CVE-2022-26505 is a high-severity vulnerability in Readymedia Project Readymedia with a CVSS 3.x base score of 7.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-290.

Key facts

• Severity: High (CVSS 3.x base score 7.4)
• CVSS v2: 4.3
• EPSS exploit prediction: 2% (73rd percentile)
• Actively exploited: Not listed in CISA KEV
• Weakness: CWE-290
• Affected product: Readymedia Project Readymedia
• Published: 2022-03-06
• Last modified: 2026-06-17

Description

A DNS rebinding issue in ReadyMedia (formerly MiniDLNA) before 1.3.1 allows a remote web server to exfiltrate media files.

Frequently asked questions

What is CVE-2022-26505?

A DNS rebinding issue in ReadyMedia (formerly MiniDLNA) before 1.3.1 allows a remote web server to exfiltrate media files.

How severe is CVE-2022-26505?

CVE-2022-26505 has a CVSS 3.x base score of 7.4, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2022-26505 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (73rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2022-26505?

CVE-2022-26505 primarily affects Readymedia Project Readymedia. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2022-26505?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2022-26505 published?

CVE-2022-26505 was published on 2022-03-06 and last updated on 2026-06-17.

References

• http://www.openwall.com/lists/oss-security/2022/03/06/1
• https://lists.debian.org/debian-lts-announce/2022/04/msg00005.html
• https://security.gentoo.org/glsa/202311-12
• https://sourceforge.net/p/minidlna/git/ci/c21208508dbc131712281ec5340687e5ae89e940/
• https://www.openwall.com/lists/oss-security/2022/03/03/1

Affected products (2)

• cpe:2.3:a:readymedia_project:readymedia:*:*:*:*:*:*:*:*
• cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

More vulnerabilities in Readymedia Project Readymedia

• CVE-2023-33476 — Critical (CVSS 9.8): ReadyMedia (MiniDLNA) versions from 1.1.15 up to 1.3.2 is vulnerable to Buffer Overflow. The vulnerability is caused by…
• CVE-2020-28926 — Critical (CVSS 9.8): ReadyMedia (aka MiniDLNA) before versions 1.3.0 allows remote code execution. Sending a malicious UPnP HTTP request to…
• CVE-2013-2739 — Critical (CVSS 9.8): MiniDLNA has heap-based buffer overflow
• CVE-2013-2738 — Critical (CVSS 9.8): minidlna has SQL Injection that may allow retrieval of arbitrary files
• CVE-2023-47430 — High (CVSS 7.5): Stack-buffer-overflow vulnerability in ReadyMedia (MiniDLNA) v1.3.3 allows attackers to cause a denial of service via…

All CVEs affecting Readymedia Project Readymedia →

Other CWE-290 vulnerabilities

• CVE-2026-54782 — Critical (CVSS 10.0): CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1,…
• CVE-2026-48567 — Critical (CVSS 10.0): Authentication bypass by spoofing in Azure HorizonDB allows an unauthorized attacker to elevate privileges over a…
• CVE-2026-6213 — Critical (CVSS 10.0): A vulnerability in Remote Spark SparkView before build 1122 allows an attacker to bypasses the local connection check…
• CVE-2026-39858 — Critical (CVSS 10.0): Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a high…
• CVE-2025-66570 — Critical (CVSS 10.0): cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.27.0, a vulnerability…
• CVE-2025-34063 — Critical (CVSS 10.0): A cryptographic authentication bypass vulnerability exists in OneLogin AD Connector prior to 6.1.5 due to the exposure…

Browse all CWE-290 vulnerabilities →