VLC for Android < 3.7.0 Remote Access Path Traversal
VideoLAN VLC for Android prior to version 3.7.0 contains a path traversal vulnerability in the Remote Access Server routing for the authenticated endpoint GET /download. The file query parameter is concatenated into a filesystem path under the configured download directory without canonicalization or directory containment checks, allowing an authenticated attacker with network reachability to the Remote Access Server to request files outside the intended directory. The impact is bounded by the Android application sandbox and storage restrictions, typically limiting exposure to app-internal and app-specific external storage.
CVE-2026-26228
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-26228
VLC for Android
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://github.com/videolan/vlc-android",
"vendor": "VideoLAN",
"product": "VLC for Android",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "3.7.0",
"versionType": "semver"
}
],
"platforms": [
"Android"
],
"packageURL": "pkg:github/videolan/vlc-android",
"packageName": "vlc-android",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-26228
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #17211 · Revision 1
- Added to Heist Feed
- Publisher date