p PatchFirst

CVE-2026-102875

CVE-2026-102875 · VLC media player before 3.0.24 Path Traversal via skins2

This page contains facts from public vulnerability sources. Check the original advisory before updating.

VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives. Attackers can craft malicious skin files with path traversal sequences to write arbitrary files with VLC user privileges, enabling code execution through Lua script injection.

CVSS 8.5 · High · EPSS 0.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • vlc

    Versions
    • ≥ 0, < 3.0.24: Affected (semver)
    • 3.0.24: Not affected (semver)

    Update to 3.0.24

  • vlc Debian:12

    Versions
    • 3.0.18-2
    • 3.0.18-3
    • 3.0.18-4
    • 3.0.19-1
    • 3.0.20-0+deb12u1
    • 3.0.20-1
    • 3.0.20-2
    • 3.0.20-3
    • 3.0.20-4
    • 3.0.21-0+deb12u1
    • 3.0.21-1
    • 3.0.21-10
    • 3.0.21-11
    • 3.0.21-2
    • 3.0.21-3
    • 3.0.21-4
    • 3.0.21-4~exp1
    • 3.0.21-5
    • 3.0.21-6
    • 3.0.21-7
    • 3.0.21-8
    • 3.0.21-9
    • 3.0.22-0+deb12u1
    • 3.0.22-1
    • 3.0.22-2
    • 3.0.22-3
    • 3.0.22-4
    • 3.0.22~rc1-1
    • 3.0.22~rc2-1
    • 3.0.23-0+deb12u1
    • 3.0.23-1
    • 3.0.23-2
    • 3.0.23-3
    • 3.0.24-1
    • 3.0.24-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • vlc Debian:13

    Versions
    • 3.0.21-10
    • 3.0.21-11
    • 3.0.22-0+deb13u1
    • 3.0.22-1
    • 3.0.22-2
    • 3.0.22-3
    • 3.0.22-4
    • 3.0.22~rc1-1
    • 3.0.22~rc2-1
    • 3.0.23-0+deb13u1
    • 3.0.23-1
    • 3.0.23-2
    • 3.0.23-3
    Affected ranges
    • ECOSYSTEM: < 3.0.24-0+deb13u1

    Update to 3.0.24-0+deb13u1

  • vlc Debian:14

    Versions
    • 3.0.21-10
    • 3.0.21-11
    • 3.0.22-1
    • 3.0.22-2
    • 3.0.22-3
    • 3.0.22-4
    • 3.0.22~rc1-1
    • 3.0.22~rc2-1
    • 3.0.23-1
    • 3.0.23-2
    • 3.0.23-3
    Affected ranges
    • ECOSYSTEM: < 3.0.24-1

    Update to 3.0.24-1

  • vlc Ubuntu:Pro:16.04:LTS

    Versions
    • 2.2.1-3
    • 2.2.1-5
    • 2.2.2-1
    • 2.2.2-2
    • 2.2.2-3
    • 2.2.2-3build1
    • 2.2.2-4
    • 2.2.2-5
    • 2.2.2-5ubuntu0.16.04.1
    • 2.2.2-5ubuntu0.16.04.2
    • 2.2.2-5ubuntu0.16.04.3
    • 2.2.2-5ubuntu0.16.04.4
    • 2.2.2-5ubuntu0.16.04.5+esm1
    • 2.2.2-5ubuntu0.16.04.5+esm2
    • 2.2.2-5ubuntu0.16.04.5+esm3
    • 2.2.2-5ubuntu0.16.04.5+esm4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • vlc Ubuntu:Pro:18.04:LTS

    Versions
    • 2.2.6-6
    • 2.2.6-6build1
    • 2.2.7-1
    • 2.2.8-1
    • 2.2.8-1ubuntu4
    • 2.2.8-2
    • 3.0.0~rc1-1ubuntu1
    • 3.0.0~rc1-1ubuntu3
    • 3.0.0~rc2-1ubuntu1
    • 3.0.0~rc2-2ubuntu1
    • 3.0.0~rc2-2ubuntu2
    • 3.0.0~rc4-1ubuntu1
    • 3.0.0~rc7-2ubuntu1
    • 3.0.0~rc8-1ubuntu1
    • 3.0.0-1ubuntu1
    • 3.0.1-1ubuntu5
    • 3.0.1-2ubuntu1
    • 3.0.1-2ubuntu2
    • 3.0.1-3
    • 3.0.1-3build1
    • 3.0.2-0ubuntu0.1
    • 3.0.3-1-1ubuntu1
    • 3.0.4-1ubuntu0.2
    • 3.0.7.1-0ubuntu18.04.1
    • 3.0.8-0ubuntu18.04.1
    • 3.0.8-0ubuntu18.04.1+esm1
    • 3.0.8-0ubuntu18.04.1+esm2
    • 3.0.8-0ubuntu18.04.1+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • vlc Ubuntu:Pro:20.04:LTS

    Versions
    • 3.0.8-2
    • 3.0.8-2build1
    • 3.0.8-3
    • 3.0.8-3build1
    • 3.0.8-3build2
    • 3.0.8-3build4
    • 3.0.8-4
    • 3.0.9.2-1
    • 3.0.9.2-1ubuntu0.1~esm1
    • 3.0.9.2-1ubuntu0.1~esm2
    • 3.0.9.2-1ubuntu0.1~esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • vlc Ubuntu:Pro:22.04:LTS

    Versions
    • 3.0.16-1
    • 3.0.16-1build1
    • 3.0.16-1build2
    • 3.0.16-1build3
    • 3.0.16-1build4
    • 3.0.16-1build5
    • 3.0.16-1build7
    • 3.0.16-1ubuntu0.1~esm1
    • 3.0.16-1ubuntu0.1~esm2
    • 3.0.16-1ubuntu0.1~esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • vlc Ubuntu:Pro:24.04:LTS

    Versions
    • 3.0.18-4
    • 3.0.19-1
    • 3.0.19-1build1
    • 3.0.20-1build1
    • 3.0.20-3build6
    • 3.0.20-3ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • vlc Ubuntu:26.10

    Versions
    • 3.0.23-1
    • 3.0.23-3
    • 3.0.23-3build1
    • 3.0.24-1
    • 3.0.24-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • vlc Ubuntu:26.04:LTS

    Versions
    • 3.0.21-11
    • 3.0.22~rc1-1
    • 3.0.22~rc1-1build1
    • 3.0.22~rc1-1build2
    • 3.0.22~rc1-1build3
    • 3.0.22~rc2-1
    • 3.0.22-1
    • 3.0.22-2
    • 3.0.22-2build1
    • 3.0.22-4
    • 3.0.23-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →