CVE-2026-83526

Name of the Vulnerable Software and Affected Versions FV Player 8 versions prior to 8.1.8

Description Insufficient file type validation in the check mimetype() function allows authenticated users with subscriber-level access and above to perform an arbitrary file upload. The issue occurs because the function writes remote file content to the public uploads directory before performing MIME or extension checks, and lacks a capability check during new player creation. By exploiting a race condition, an attacker can upload executable files to achieve remote code execution.

Recommendations Update FV Player 8 to version 8.1.8 or later. As a temporary mitigation, restrict access to the check mimetype() function or limit user permissions to prevent subscriber-level accounts from creating new players.