CVE-2026-82504: VITEC EZ TV Platform Server Unauthenticated File Upload via UploadHandler.ashx
VITEC EZ TV Platform Server before 8.5.0 contains an unrestricted file upload vulnerability in the upload handler that allows unauthenticated remote attackers to upload arbitrary files by supplying a target filename in the X-FILENAME request header with no authentication or file type validation required. Attackers can upload a malicious ASPX file directly to the web-accessible uploads directory, where it is immediately executable by the web server, achieving remote code execution in the context of the web server process. Patches are available for versions 8.3.0, 8.3.1, 8.4.0, and 8.4.1. Users running releases prior to 8.3.0 should upgrade to 8.5.0+.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
VITEC EZ TV Platform Serverto a version that resolves this vulnerability.Fixed in 8.5.0 - Operational
If running an EZ TV Platform Server version prior to 8.5.0, contact the Vitec Helpdesk immediately to schedule a patch or upgrade.
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated exploitation?
VITEC EZ TV Platform Server versions before 8.5.0 are affected. An attacker can reach the vulnerable upload handler remotely without credentials, so internet- or network-accessible deployments are exposed if the handler is reachable.
What does an attacker need to exploit this issue?
The attacker needs only network access to the affected server's upload handler. They can provide a target filename through the X-FILENAME request header; no authentication or file-type validation is required.
What is the likely impact of a successful upload?
An attacker can upload a malicious ASPX file into the web-accessible uploads directory. Because the web server immediately executes the uploaded file, this can result in remote code execution in the web server process context.
Which upgrade path is available?
Patches are available for versions 8.3.0, 8.3.1, 8.4.0, and 8.4.1. Deployments running releases earlier than 8.3.0 should upgrade to version 8.5.0 or later.