CVE-2026-34015: Remote Code Execution in upload.php of Video Station
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.
We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker must first obtain a user account. The provided information does not indicate that unauthenticated attackers can exploit it.
What is the confirmed impact?
The reported path traversal issue can allow an authenticated remote attacker to read unexpected files or system data. Although the title references remote code execution, the description only confirms unauthorized file or system-data disclosure.
Which versions are fixed?
Video Station 5.8.8 and later include the fix. Systems running an earlier version may be affected based on the provided information.