Affected: streamlink

Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.6.0, HTTPSession mounts a FileAdapter for the file scheme and inherits redirect handling from requests.Session without rejecting cross-protocol redirects. A remote server controlling an HTTP or HTTPS URL reached by Streamlink can return a redirect to a local file URL, causing HTTPSession to read the local file and return its contents to the response consumer. This bypasses the direct file URL checks added for HLS and DASH content because the manifest contains an ordinary network URL and the scheme transition occurs later during fetch handling. The flaw applies to every request made through HTTPSession, and a segment fetch can place the local file contents into stream output. This issue is fixed in version 8.6.0.

Affected: PyPI: streamlink

## Summary

`HTTPSession` mounts a `FileAdapter` for the `file://` scheme and inherits redirect handling unchanged from `requests.Session`. `requests` does not check for scheme downgrades or cross-protocol transitions when it follows a redirect, so any http(s) request Streamlink makes can be redirected by the remote server into `file:///...` and the local file is returned as the response body.

`GHSA-hgqw-6m45-hw5f` / `CVE-2026-44353` fixed direct `file://` segment and playlist URIs in HLS playlists and DASH manifests. Those checks look at the URL as it appears in the manifest, so a manifest that lists an ordinary `https://` URL passes them, and the redirect happens later at fetch time. The attack surface is the same one that advisory describes, but the flaw is one level down in `HTTPSession` rather than in the streaming implementations, so it applies to every request the session makes and not only to segment and manifest fetches.

## Affected version

Executed against released `streamlink 8.5.0` (PyPI, installed into a clean venv on Python 3.12).

## Attacker model

The attacker controls a URL the victim's Streamlink run reaches: a playlist or manifest URL passed on the command line, or any http(s) URL referenced from attacker-controlled manifest content. No privileges on the victim host and no `file://` input are required, and the `file://` scheme never appears in anything the victim or the manifest parser sees.

## Proof of concept, executed

```python import threading fr…