Path Traversal Vulnerability in VLC Media Player for Android by VideoLAN

CVE-2026-26228

What is CVE-2026-26228?

A path traversal vulnerability exists in VLC Media Player for Android prior to version 3.7.0. The flaw arises in the Remote Access Server's handling of the GET /download request, where the file query parameter is directly concatenated into a filesystem path in the configured download directory. This lack of proper validation allows an authenticated attacker, given network access to the Remote Access Server, to manipulate the request and access files outside the intended directory structure. However, the impact is restricted by the Android application sandbox, typically confining exposure to app-internal files and specific external storage.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References