CVE-2026-102875
VLC media player before 3.0.24 Path Traversal via skins2
videolan vlc
CVSS
8.5HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 3.0.24vlcCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives. Attackers can craft malicious skin files with path traversal sequences to write arbitrary files with VLC user privileges, enabling code execution through Lua script injection.
Text from CVE List
Affected versions 2
- vlcaffected: all versions before 3.0.24CVE List
- vlcunaffected: 3.0.24CVE List
References 5
- code.videolan.org/videolan/vlc/-/commit/59934edbd03c6c1147d75d6c91e96633b710ec31Fixvia CVE List
- code.videolan.org/videolan/vlc/-/commit/8d43e99c2c01d9aab3ecad00e7a102806262b06bFixvia CVE List
- vulncheck.com/advisories/vlc-media-player-before-3.0.24-path-traversal-via-skins2Advisoryvia CVE List
- code.videolan.org/videolan/vlc/-/blob/3.0.23/modules/gui/skins2/src/theme_loader.cppReferencevia CVE List
- code.videolan.org/videolan/vlcReferencevia CVE List