CVE-2026-26228

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-26228
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-26228.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-26228
Published
2026-02-26T15:21:00.590Z
Modified
2026-08-12T03:51:17.709637979Z
Severity
  • 2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
VLC for Android < 3.7.0 Remote Access Path Traversal
Details

VideoLAN VLC for Android prior to version 3.7.0 contains a path traversal vulnerability in the Remote Access Server routing for the authenticated endpoint GET /download. The file query parameter is concatenated into a filesystem path under the configured download directory without canonicalization or directory containment checks, allowing an authenticated attacker with network reachability to the Remote Access Server to request files outside the intended directory. The impact is bounded by the Android application sandbox and storage restrictions, typically limiting exposure to app-internal and app-specific external storage.

Database specific 
{
    "cwe_ids": [
        "CWE-22",
        "CWE-73"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26228.json",
    "cna_assigner": "VulnCheck"
}
References

Affected packages

Git / github.com/videolan/vlc-android

Affected ranges

Type
GIT
Repo
https://github.com/videolan/vlc-android
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
2e44dfbb4a5a8f4a282adea4270e97baaa481d23
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.7.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.0.1
0.0.10
0.0.11
0.0.2
0.0.3
0.0.4
0.0.5
0.0.6
0.0.7
0.0.8
0.0.9
0.1.0
0.1.1
0.1.2
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
0.9.5
0.9.6
0.9.7
0.9.7.1
0.9.8
0.9.9
1.*
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.99
1.5.0
1.5.1
1.5.1.1
1.5.2
1.5.90
1.6.0
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.7.0
1.9.0
1.9.1
1.9.10
1.9.11
1.9.12
1.9.13
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
1.9.8
1.9.9
2.*
2.0.0-RC1
2.1.0
2.1.1
2.1.10
2.1.11
2.1.12
2.1.13
2.1.14
2.1.15
2.1.16
2.1.17
2.1.17-1
2.1.18
2.1.19
2.1.2
2.1.20
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.7
2.9.0
2.9.1
3.*
3.0.0
3.0.1-1
3.0.92
3.0.93
3.0.94
3.0.95
3.0.96
3.0.97
3.0.98
3.0.99
3.2.81
3.2.82
3.2.83
3.2.84
3.2.86
3.2.87
3.2.88
3.2.89
3.2.90
3.2.91
3.2.92
3.3.0-RC1
3.3.0-RC2
3.3.0-RC3
3.3.0-RC4
3.3.0-beta01
3.3.0-beta02
3.3.0-beta03
3.3.0-beta04
3.3.0-beta06
3.3.0-beta07
3.3.1-beta01
3.3.1-beta02
3.3.3
3.3.3-beta01
3.3.3-beta02
3.3.3-beta03
3.3.3-beta04
3.3.4-beta01
3.3.4-beta02
3.4.0
3.4.0-beta01
3.4.0-beta02
3.4.0-beta03
3.4.0-beta04
3.4.0-beta05
3.4.0-beta06
3.4.0-rc1
3.4.0-rc2
3.4.1
3.4.1-beta01
3.4.1-beta02
3.4.1-beta03
3.4.2
3.4.3-beta01
3.4.3-beta02
3.5.0
3.5.0-beta01
3.5.0-beta02
3.5.0-beta03
3.5.0-beta04
3.5.0-beta05
3.5.0-beta06
3.5.0-beta07
3.5.0-rc1
3.5.0-rc2
3.5.0-rc3
3.5.1
3.5.1-beta01
3.5.2-beta01
3.6.0
3.6.0-beta01
3.6.0-beta02
3.6.0-beta03
3.6.0-beta04
3.6.0-beta05
3.6.0-beta06
3.6.1
3.6.2
3.6.3
3.6.4
3.6.4-beta01
3.6.4-beta02
3.6.4-beta03
3.6.4-beta04
3.6.4-beta05
3.6.5
3.6.5-1
3.7.0
3.7.0-beta01
3.7.0-beta02
3.7.0-beta03
3.7.0-beta04
libvlc-3.*
libvlc-3.3.0
libvlc-3.3.0-eap10
libvlc-3.3.0-eap11
libvlc-3.3.0-eap12
libvlc-3.3.0-eap13
libvlc-3.3.0-eap14
libvlc-3.3.0-eap15
libvlc-3.3.0-eap16
libvlc-3.3.0-eap17
libvlc-3.3.0-eap5
libvlc-3.3.0-eap6
libvlc-3.3.0-eap7
libvlc-3.3.0-eap8
libvlc-3.3.0-eap9
libvlc-3.3.1
libvlc-3.3.11
libvlc-3.3.12
libvlc-3.3.13
libvlc-3.3.2
libvlc-3.3.3
libvlc-3.3.6
libvlc-3.3.7
libvlc-3.3.9
libvlc-3.4.0-eap7
libvlc-3.4.0-eap8
libvlc-3.4.0-eap9
libvlc-3.4.1
libvlc-3.4.2
libvlc-3.4.3
libvlc-3.4.4
libvlc-3.4.5
libvlc-3.4.6
libvlc-3.4.7
libvlc-3.4.8
libvlc-3.5.0-eap1
libvlc-3.5.0-eap2
libvlc-3.5.0-eap3
libvlc-3.5.0-eap4
libvlc-3.5.0-eap5
libvlc-3.5.0-eap6
libvlc-3.5.0-eap7
libvlc-3.5.0-eap8
libvlc-3.5.1
libvlc-3.5.1-eap1
libvlc-3.5.2-eap1
libvlc-3.6.0
libvlc-3.6.0-eap1
libvlc-3.6.0-eap10
libvlc-3.6.0-eap11
libvlc-3.6.0-eap12
libvlc-3.6.0-eap13
libvlc-3.6.0-eap14
libvlc-3.6.0-eap2
libvlc-3.6.0-eap3
libvlc-3.6.0-eap4
libvlc-3.6.0-eap5
libvlc-3.6.0-eap6
libvlc-3.6.0-eap7
libvlc-3.6.0-eap8
libvlc-3.6.0-eap9
libvlc-3.6.1
libvlc-3.6.2
libvlc-3.6.3
libvlc-3.6.4
libvlc-3.6.5
libvlc-4.*
libvlc-4.0.0-eap10
libvlc-4.0.0-eap11
libvlc-4.0.0-eap12
libvlc-4.0.0-eap13
libvlc-4.0.0-eap14
libvlc-4.0.0-eap15
libvlc-4.0.0-eap16
libvlc-4.0.0-eap17
libvlc-4.0.0-eap18
libvlc-4.0.0-eap19
libvlc-4.0.0-eap2
libvlc-4.0.0-eap20
libvlc-4.0.0-eap21
libvlc-4.0.0-eap22
libvlc-4.0.0-eap23
libvlc-4.0.0-eap3
libvlc-4.0.0-eap4
libvlc-4.0.0-eap5
libvlc-4.0.0-eap6
libvlc-4.0.0-eap7
libvlc-4.0.0-eap8
libvlc-4.0.0-eap9
Other
libvlc-eap4
remoteaccess-0.*
remoteaccess-0.1.1
remoteaccess-0.1.2
remoteaccess-0.1.3
remoteaccess-0.10.0
remoteaccess-0.11.0
remoteaccess-0.12.0
remoteaccess-0.2.0
remoteaccess-0.3.0
remoteaccess-0.4.0
remoteaccess-0.5.0
remoteaccess-0.6.0
remoteaccess-0.7.0
remoteaccess-0.8.0
remoteaccess-0.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-26228.json"