CVE-2026-30121: remotion-dev remotion v4

Synopsis

An arbitrary file write vulnerability affects remotion-dev remotion v4.0.409. It is reachable over the network and requires no authentication, meaning any client that can reach the service can trigger the flaw. Successful exploitation allows an attacker to write arbitrary files to the host filesystem, enabling tampering with application data or escalation to remote code execution by overwriting executable paths or configuration. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable service must be reachable over the network; an attacker sends a crafted request from any remote host without needing LAN or physical access.

• AuthenticationNot required

  No credentials or session token are needed; the exploit is available to any unauthenticated client that can reach the endpoint.

• Victim interactionNot required

  The attacker does not need to trick a user into any action; exploitation is fully server-side.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, memory layout knowledge, or special environmental state is required.

Blast Radius

• Attacker writes arbitrary files to any path the process user can reach on the host filesystem.
• Overwriting scripts, binaries, or configuration files on the host can lead to remote code execution on the next invocation of those files.
• Application data and persisted state stored on the filesystem can be modified or replaced, corrupting outputs or poisoning downstream consumers.
• Integrity of the container image or mounted volumes is compromised, which may propagate malicious content to sibling containers sharing the same storage.