CVE-2026-92164: Streamlink: HTTPSession follows HTTP redirects into file:// URLs, reading local files

HTTPSession mounts a FileAdapter for the file:// scheme and inherits redirect handling unchanged from requests.Session. requests does not check for scheme downgrades or cross-protocol transitions when it follows a redirect, so any http(s) request Streamlink makes can be redirected by the remote server into file:///... and the local file is returned as the response body.

GHSA-hgqw-6m45-hw5f / CVE-2026-44353 fixed direct file:// segment and playlist URIs in HLS playlists and DASH manifests. Those checks look at the URL as it appears in the manifest, so a manifest that lists an ordinary https:// URL passes them, and the redirect happens later at fetch time. The attack surface is the same one that advisory describes, but the flaw is one level down in HTTPSession rather than in the streaming implementations, so it applies to every request the session makes and not only to segment and manifest fetches.