CVE-2017-5982: Kodi Chorus2 add-on directory traversal allows arbitrary file read

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityNetwork-reachable arbitrary file read with no authentication required and very high EPSS, but no KEV listing or documented ransomware use.

What it is

The Chorus2 2.4.2 add-on for Kodi contains a directory traversal flaw in its image path handling. A crafted encoded dot-dot-slash sequence lets a remote attacker read files outside the intended directory, including sensitive system files such as /etc/passwd. The record does not list affected Kodi versions beyond the add-on version named in the description.

Impact

An attacker gains read access to arbitrary files on the host running the vulnerable add-on, which can expose credentials, configuration and other sensitive data. There is no write or code execution impact in the supplied data.

Attack surface

The flaw is network reachable (AV:N) with no privileges or user interaction required (PR:N, UI:N), reached through the image path parameter of the Chorus2 add-on. Any exposed Kodi instance running the affected add-on is a candidate target.

Exploitation

Public exploit references exist (Exploit-DB, Packet Storm, Full Disclosure) and EPSS is very high at 0.7763 (99.54th percentile), though the CVE is not listed in CISA KEV. No ransomware group usage is documented.

What to do

• Update or remove the Chorus2 add-on; apply the vendor or distribution fix for the affected Kodi package.
• Do not expose Kodi web interfaces or add-on endpoints to untrusted networks; restrict access to trusted hosts.
• Run Kodi with least privilege so file reads are limited to non-sensitive data.
• Monitor Debian LTS and other distribution advisories for updated packages covering this issue.

Detection

• Inspect web or add-on access logs for image path parameters containing encoded traversal sequences such as %2E%2E%252e or %2e%2e%252f.
• Alert on requests referencing sensitive paths like /etc/passwd or other system files through the Kodi add-on interface.
• Baseline normal image path values and flag anomalous encoded or double-encoded input.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.