Authenticated file disclosure via uncataloged transcoder paths

Authorization bypass in Zoriya Kyoo before 5.1.0 allows remote authenticated users to read uncataloged files under the media directory. The transcoder decodes a caller-supplied base64 filesystem path, checks only its cleaned media-directory prefix, and serves it without confirming a Kyoo catalog record. A registered account with core.play and a known or guessed path is required, limiting exposure to readable files beneath the configured media directory.