CVE-2026-26228

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-26228
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-26228.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-26228
Published
2026-02-26T16:24:07.343Z
Modified
2026-03-01T02:23:33.573594Z
Severity
  • 4.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:L CVSS Calculator
Summary
[none]
Details

VideoLAN VLC for Android prior to version 3.7.0 contains a path traversal vulnerability in the Remote Access Server routing for the authenticated endpoint GET /download. The file query parameter is concatenated into a filesystem path under the configured download directory without canonicalization or directory containment checks, allowing an authenticated attacker with network reachability to the Remote Access Server to request files outside the intended directory. The impact is bounded by the Android application sandbox and storage restrictions, typically limiting exposure to app-internal and app-specific external storage.

References

Affected packages

Git / github.com/videolan/vlc-android

Affected ranges

Type
GIT
Repo
https://github.com/videolan/vlc-android
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
d613fda0af1dc55b56b4c961180fa1cffe36fc79

Affected versions

0.*
0.0.1
0.0.10
0.0.11
0.0.2
0.0.3
0.0.4
0.0.5
0.0.6
0.0.7
0.0.8
0.0.9
0.1.0
0.1.1
0.1.2
0.9.0
0.9.1
0.9.2
0.9.3
0.9.4
0.9.5
0.9.6
0.9.7
0.9.7.1
0.9.8
0.9.9
1.*
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.99
1.5.0
1.5.1
1.5.1.1
1.5.2
1.5.90
1.6.0
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.7.0
1.9.0
1.9.1
1.9.10
1.9.11
1.9.12
1.9.13
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
1.9.8
1.9.9
2.*
2.0.0-RC1
2.1.0
2.1.1
2.1.10
2.1.11
2.1.12
2.1.13
2.1.14
2.1.15
2.1.16
2.1.17
2.1.17-1
2.1.18
2.1.19
2.1.2
2.1.20
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.7
2.9.0
2.9.1
3.*
3.0.0
3.0.1-1
3.0.92
3.0.93
3.0.94
3.0.95
3.0.96
3.0.97
3.0.98
3.0.99
3.2.81
3.2.82
3.2.83
3.2.84
3.2.86
3.2.87
3.2.88
3.2.89
3.2.90
3.2.91
3.2.92
3.3.0-RC1
3.3.0-RC2
3.3.0-RC3
3.3.0-RC4
3.3.0-beta01
3.3.0-beta02
3.3.0-beta03
3.3.0-beta04
3.3.0-beta06
3.3.0-beta07
3.3.1-beta01
3.3.1-beta02
3.3.3
3.3.3-beta01
3.3.3-beta02
3.3.3-beta03
3.3.3-beta04
3.3.4-beta01
3.3.4-beta02
3.4.0
3.4.0-beta01
3.4.0-beta02
3.4.0-beta03
3.4.0-beta04
3.4.0-beta05
3.4.0-beta06
3.4.0-rc1
3.4.0-rc2
3.4.1
3.4.1-beta01
3.4.1-beta02
3.4.1-beta03
3.4.2
3.4.3-beta01
3.4.3-beta02
3.5.0
3.5.0-beta01
3.5.0-beta02
3.5.0-beta03
3.5.0-beta04
3.5.0-beta05
3.5.0-beta06
3.5.0-beta07
3.5.0-rc1
3.5.0-rc2
3.5.0-rc3
3.5.1
3.5.1-beta01
3.5.2-beta01
3.6.0
3.6.0-beta01
3.6.0-beta02
3.6.0-beta03
3.6.0-beta04
3.6.0-beta05
3.6.0-beta06
3.6.1
3.6.2
3.6.3
3.6.4
3.6.4-beta01
3.6.4-beta02
3.6.4-beta03
3.6.4-beta04
3.6.4-beta05
3.6.5
3.6.5-1
3.7.0-beta01
3.7.0-beta02
3.7.0-beta03
3.7.0-beta04
libvlc-3.*
libvlc-3.3.0
libvlc-3.3.0-eap10
libvlc-3.3.0-eap11
libvlc-3.3.0-eap12
libvlc-3.3.0-eap13
libvlc-3.3.0-eap14
libvlc-3.3.0-eap15
libvlc-3.3.0-eap16
libvlc-3.3.0-eap17
libvlc-3.3.0-eap5
libvlc-3.3.0-eap6
libvlc-3.3.0-eap7
libvlc-3.3.0-eap8
libvlc-3.3.0-eap9
libvlc-3.3.1
libvlc-3.3.11
libvlc-3.3.12
libvlc-3.3.13
libvlc-3.3.2
libvlc-3.3.3
libvlc-3.3.6
libvlc-3.3.7
libvlc-3.3.9
libvlc-3.4.0-eap7
libvlc-3.4.0-eap8
libvlc-3.4.0-eap9
libvlc-3.4.1
libvlc-3.4.2
libvlc-3.4.3
libvlc-3.4.4
libvlc-3.4.5
libvlc-3.4.6
libvlc-3.4.7
libvlc-3.4.8
libvlc-3.5.0-eap1
libvlc-3.5.0-eap2
libvlc-3.5.0-eap3
libvlc-3.5.0-eap4
libvlc-3.5.0-eap5
libvlc-3.5.0-eap6
libvlc-3.5.0-eap7
libvlc-3.5.0-eap8
libvlc-3.5.1
libvlc-3.5.1-eap1
libvlc-3.5.2-eap1
libvlc-3.6.0
libvlc-3.6.0-eap1
libvlc-3.6.0-eap10
libvlc-3.6.0-eap11
libvlc-3.6.0-eap12
libvlc-3.6.0-eap13
libvlc-3.6.0-eap14
libvlc-3.6.0-eap2
libvlc-3.6.0-eap3
libvlc-3.6.0-eap4
libvlc-3.6.0-eap5
libvlc-3.6.0-eap6
libvlc-3.6.0-eap7
libvlc-3.6.0-eap8
libvlc-3.6.0-eap9
libvlc-3.6.1
libvlc-3.6.2
libvlc-3.6.3
libvlc-3.6.4
libvlc-3.6.5
libvlc-4.*
libvlc-4.0.0-eap10
libvlc-4.0.0-eap11
libvlc-4.0.0-eap12
libvlc-4.0.0-eap13
libvlc-4.0.0-eap14
libvlc-4.0.0-eap15
libvlc-4.0.0-eap16
libvlc-4.0.0-eap17
libvlc-4.0.0-eap18
libvlc-4.0.0-eap19
libvlc-4.0.0-eap2
libvlc-4.0.0-eap20
libvlc-4.0.0-eap21
libvlc-4.0.0-eap22
libvlc-4.0.0-eap23
libvlc-4.0.0-eap3
libvlc-4.0.0-eap4
libvlc-4.0.0-eap5
libvlc-4.0.0-eap6
libvlc-4.0.0-eap7
libvlc-4.0.0-eap8
libvlc-4.0.0-eap9
Other
libvlc-eap4
remoteaccess-0.*
remoteaccess-0.1.1
remoteaccess-0.1.2
remoteaccess-0.1.3
remoteaccess-0.10.0
remoteaccess-0.11.0
remoteaccess-0.2.0
remoteaccess-0.3.0
remoteaccess-0.4.0
remoteaccess-0.5.0
remoteaccess-0.6.0
remoteaccess-0.7.0
remoteaccess-0.8.0
remoteaccess-0.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-26228.json"