PT-2026-102891
CVE-2026-102875
·
Published
2026-09-29
·
Updated
2026-09-29
Description by
CVSS 4.0
8.5
HighMetricsAV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
VLC media player versions prior to 3.0.24
Description
A path traversal issue exists in the skins2 ThemeLoader due to insufficient validation of member names within .vlt skin archives. This allows an attacker to use path traversal sequences in malicious skin files to write arbitrary files with the privileges of the VLC user, which can lead to code execution via Lua script injection.
Recommendations
Update to version 3.0.24 or later.
Found an issue in the description? Have something to add? Feel free to write us 👾