PT-2026-102891 · Debian+2 · Vlc
CVSS v4.0
8.5
عالية
| المتجه | AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
VLC media player versions prior to 3.0.24
Description
A path traversal issue exists in the skins2 ThemeLoader due to insufficient validation of member names within .vlt skin archives. This allows an attacker to use path traversal sequences in malicious skin files to write arbitrary files with the privileges of the VLC user, which can lead to code execution via Lua script injection.
Recommendations
Update to version 3.0.24 or later.
إصلاح
Path traversal
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
تصنيف نقاط الضعف
المعرّفات ذات الصلة
المنتجات المتأثرة
Vlc