adeelahmad · Oct 6, 2026 · Oct 6, 2026
diff --git a/fastapi_backend/app/domain/ingest.py b/fastapi_backend/app/domain/ingest.py
@@ -36,11 +36,27 @@ def parse_sv(raw):
 
 
 # ---------- files ----------
+# The demuxers ffmpeg may pick for a file it is given: audio and video containers only. ffmpeg chooses by content,
+# not extension, and a playlist (concat, hls) or image sequence would make it read other files next to this one.
+MEDIA_DEMUXERS = "mp3,mov,wav,flac,ogg,aac,matroska,amr,avi,asf,mpeg,mpegts,aiff"
+
+
 def probe(path):
     ch = 0
     try:
         out = subprocess.run(
-            ["ffprobe", "-v", "error", "-show_entries", "format=duration:stream=channels,codec_type", "-of", "json", str(path)],
+            [
+                "ffprobe",
+                "-v",
+                "error",
+                "-format_whitelist",
+                MEDIA_DEMUXERS,
+                "-show_entries",
+                "format=duration:stream=channels,codec_type",
+                "-of",
+                "json",
+                str(path),
+            ],
             capture_output=True,
             text=True,
             timeout=120,
@@ -111,6 +127,8 @@ def decode(path, channels=1):
             "-nostdin",
             "-v",
             "error",
+            "-format_whitelist",
+            MEDIA_DEMUXERS,
             "-i",
             str(path),
             "-f",

diff --git a/fastapi_backend/app/domain/video.py b/fastapi_backend/app/domain/video.py
@@ -40,7 +40,10 @@ def frames_dir(cfg, rid):
 def probe_media(path):
     """kind (video or audio), size, frame rate and duration. Cover art in audio files doesn't count as video."""
     out = subprocess.run(
-        ["ffprobe", "-v", "error", "-show_streams", "-show_format", "-of", "json", str(path)], capture_output=True, text=True, timeout=120
+        ["ffprobe", "-v", "error", "-format_whitelist", ingest.MEDIA_DEMUXERS, "-show_streams", "-show_format", "-of", "json", str(path)],
+        capture_output=True,
+        text=True,
+        timeout=120,
     )
     j = json.loads(out.stdout or "{}")
     streams = j.get("streams") or []
@@ -68,6 +71,8 @@ def scene_changes(path, threshold):
             "ffmpeg",
             "-hide_banner",
             "-nostats",
+            "-format_whitelist",
+            ingest.MEDIA_DEMUXERS,
             "-i",
             str(path),
             "-map",
@@ -103,6 +108,8 @@ def extract_frame(path, t, dest, width):
             "error",
             "-ss",
             f"{t:.3f}",
+            "-format_whitelist",
+            ingest.MEDIA_DEMUXERS,
             "-i",
             str(path),
             "-frames:v",
@@ -130,6 +137,8 @@ def sample_frames(path, every, dest_dir, width):
             "-hide_banner",
             "-loglevel",
             "error",
+            "-format_whitelist",
+            ingest.MEDIA_DEMUXERS,
             "-i",
             str(path),
             "-map",

diff --git a/fastapi_backend/tests/domain/test_video.py b/fastapi_backend/tests/domain/test_video.py
@@ -5,7 +5,7 @@
 import pytest
 
 from app.domain import faces, ingest, jobs, store, video
-from tests.helpers import drain, quiet
+from tests.helpers import drain, quiet, write_wav
 from tests.video_helpers import FakeFaces, has_tesseract, make_video, needs_ffmpeg
 
 pytestmark = needs_ffmpeg
@@ -60,3 +60,16 @@ def test_face_modes(db, cfg, rid):
     faces.set_mode(db, sid, "off", cfg=cfg)
     assert (db.values("SELECT VALUE id FROM face"), db.values("SELECT VALUE id FROM face_track")) == ([], [])
     assert not list(video.frames_dir(cfg, rid).glob("face-*.jpg"))  # crops go too
+
+
+@needs_ffmpeg
+def test_ffmpeg_refuses_playlists_that_point_at_other_files(folder):
+    """ffmpeg picks a demuxer by content: a "clip.mp3" that is really an ffconcat list must not read the file it names."""
+    folder.mkdir(parents=True, exist_ok=True)
+    write_wav(folder / "secret.wav")
+    trick = folder / "clip.mp3"
+    trick.write_text("ffconcat version 1.0\nfile secret.wav\n")
+    with pytest.raises(RuntimeError):
+        ingest.decode(trick)
+    assert ingest.probe(trick)[0] is None
+    assert len(ingest.decode(folder / "secret.wav")) > 0  # real media still decodes