CVE-2026-26228: VLC for Android < 3.7.0 Remote Access Path Traversal
VideoLAN VLC for Android prior to version 3.7.0 contains a path traversal vulnerability in the Remote Access Server routing for the authenticated endpoint GET /download. The file query parameter is concatenated into a filesystem path under the configured download directory without canonicalization or directory containment checks, allowing an authenticated attacker with network reachability to the Remote Access Server to request files outside the intended directory. The impact is bounded by the Android application sandbox and storage restrictions, typically limiting exposure to app-internal and app-specific external storage.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
VideoLAN VLC for Androidto a version that resolves this vulnerability.Fixed in 3.7.0 - Compensating control
Restrict network access to the VLC for Android Remote Access Server endpoint GET /download so only trusted clients can reach it (authenticated attacker with network reachability is required for exploitation).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-26228?
The severity of CVE-2026-26228 is considered high due to its potential for unauthorized access to file systems.
How do I fix CVE-2026-26228?
To fix CVE-2026-26228, upgrade to VLC for Android version 3.7.0 or later.
Which versions of VLC for Android are affected by CVE-2026-26228?
VLC for Android versions prior to 3.7.0 are affected by CVE-2026-26228.
What kind of vulnerability is CVE-2026-26228?
CVE-2026-26228 is a path traversal vulnerability that allows unauthorized file access through a manipulated URL request.
Can CVE-2026-26228 lead to data exposure?
Yes, CVE-2026-26228 can lead to data exposure if an attacker exploits the vulnerability to access sensitive files.