What’s Vulnerable › Vulnerabilities

CVE-2026-102875: VLC media player before 3.0.24 Path Traversal via skins2

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-29 · updated 2026-09-30
• Weakness: CWE-22

Description

VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives. Attackers can craft malicious skin files with path traversal sequences to write arbitrary files with VLC user privileges, enabling code execution through Lua script injection.

Affected products

• VideoLAN VLC: before 3.0.24 — fixed in 3.0.24

How to fix

Upgrade to a fixed version: VideoLAN VLC 3.0.24. Check the vendor advisory for mitigations.

References

• https://code.videolan.org/videolan/vlc
• https://code.videolan.org/videolan/vlc/-/blob/3.0.23/modules/gui/skins2/src/theme_loader.cpp
• https://code.videolan.org/videolan/vlc/-/commit/59934edbd03c6c1147d75d6c91e96633b710ec31
• https://code.videolan.org/videolan/vlc/-/commit/8d43e99c2c01d9aab3ecad00e7a102806262b06b
• https://www.vulncheck.com/advisories/vlc-media-player-before-3.0.24-path-traversal-via-skins2

Get alerted when CVE-2026-102875 or the next vulnerability affects your stack