CVE-2026-81028 — ZLMediaKit downloadFile root-directory confinement bypass via prefix collision

ZLMediaKit’s downloadFile API restricts access to configured root directories, but a prefix comparison that does not account for directory boundaries allows files to be read from directories whose names begin with the configured root name.