CVE-2026-102875VLC media player before 3.0.24 Path Traversal via skins2
Updated under an hour ago ()
Does this affect you?
It affects videolan vlc. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 0.17%, higher than 6% of scored CVEs.
Do this next
Free account, 1 product
VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives. Attackers can craft malicious skin files with path traversal sequences to write arbitrary files with VLC user privileges, enabling code execution through Lua script injection.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-22
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 0.17% (percentile 6)
- Assigned by
- VulnCheck
- NVD analysis
- Awaiting Analysis
- Record last updated
- Sep 30, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
videolan vlc videolan:vlc (from the name) | before 3.0.24; 3.0.24 not affected | CNA record |
References
- https://code.videolan.org/videolan/vlc/-/commit/59934edbd03c6c1147d75d6c91e96633b710ec31patch
- https://code.videolan.org/videolan/vlc/-/commit/8d43e99c2c01d9aab3ecad00e7a102806262b06bpatch
- https://code.videolan.org/videolan/vlc/-/blob/3.0.23/modules/gui/skins2/src/theme_loader.cpptechnical-description
- https://code.videolan.org/videolan/vlcproduct
- https://www.vulncheck.com/advisories/vlc-media-player-before-3.0.24-path-traversal-via-skins2third-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.