Improper Path Validation in TeamViewer Linux Client and Host
CVE-2026-92371

7HIGH

Key Information:

Vendor

Teamviewer

Status
Full Client
Host
Vendor
CVE Published:
29 September 2026

What is CVE-2026-92371?

TeamViewer Full Client and Host for Linux versions prior to 15.82 are affected by an improper path validation vulnerability in the Cloud Session Recording (CSR) feature. This flaw enables a local authenticated attacker to exploit a race condition during path validation, potentially leading to unauthorized file operations in unintended locations, compromising system integrity and user data security.

Affected Version(s)

Full Client Linux 15.0 < 15.82

Host Linux 15.0 < 15.82

References

https://www.teamviewer.com/en/resources/trust-center/secu...
vendor-advisory

CVSS V3.1

Score:
7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

We thank Romain Igounet and Hugo Leclercq for the discovery and responsible disclosure.
.