EIP-2026-119423

PRE-CVE

Serviio PRO 1.8 DLNA Media Streaming Server - REST API Arbitrary Code Execution

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-119423. PoCs published by LiquidWorm.

AI-analyzed exploit summary This exploit demonstrates an unauthenticated remote code execution vulnerability in Serviio PRO 1.8 DLNA Media Streaming Server. It leverages improper access control in the Configuration REST API and unsanitized input in FFMPEGWrapper to execute arbitrary commands via cmd.exe with SYSTEM privileges.

Description

Serviio PRO 1.8 DLNA Media Streaming Server - REST API Arbitrary Code Execution

Exploits (1)

exploitdb WORKING POC
by LiquidWorm · pythonwebappswindows
https://www.exploit-db.com/exploits/41961

This exploit demonstrates an unauthenticated remote code execution vulnerability in Serviio PRO 1.8 DLNA Media Streaming Server. It leverages improper access control in the Configuration REST API and unsanitized input in FFMPEGWrapper to execute arbitrary commands via cmd.exe with SYSTEM privileges.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Serviio PRO 1.8.0.0, 1.7.1, 1.7.0, 1.6.1
No auth needed
Prerequisites: Network access to the target server · Serviio REST API accessible on port 23423
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026