DEBIAN-CVE-2026-102875
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-102875
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-102875.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-102875
- Upstream
- CVE-2026-102875
- Published
- 2026-09-29T20:17:18Z
- Modified
- 2026-10-01T09:00:47Z
- Severity
-
- 8.5 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
- Summary
- [none]
- Details
-
VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives. Attackers can craft malicious skin files with path traversal sequences to write arbitrary files with VLC user privileges, enabling code execution through Lua script injection.
- References
Affected packages
Debian:12 / vlc
Package
- Name
- vlc
- Purl
- pkg:deb/debian/vlc?arch=source&distro=bookworm
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Affected versions
3.*
3.0.18-2
3.0.18-3
3.0.18-4
3.0.19-1
3.0.20-0+deb12u1
3.0.20-1
3.0.20-2
3.0.20-3
3.0.20-4
3.0.21-0+deb12u1
3.0.21-1
3.0.21-2
3.0.21-3
3.0.21-4~exp1
3.0.21-4
3.0.21-5
3.0.21-6
3.0.21-7
3.0.21-8
3.0.21-9
3.0.21-10
3.0.21-11
3.0.22~rc1-1
3.0.22~rc2-1
3.0.22-0+deb12u1
3.0.22-1
3.0.22-2
3.0.22-3
3.0.22-4
3.0.23-0+deb12u1
3.0.23-1
3.0.23-2
3.0.23-3
3.0.24-1
3.0.24-2
Debian:13 / vlc
Package
- Name
- vlc
- Purl
- pkg:deb/debian/vlc?arch=source&distro=trixie
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed3.0.24-0+deb13u1
Debian:14 / vlc
Package
- Name
- vlc
- Purl
- pkg:deb/debian/vlc?arch=source&distro=forky
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed3.0.24-1