Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
VideoLAN VLC for Android prior to version 3.7.0 contains a path traversal vulnerability in the Remote Access Server routing for the authenticated endpoint GET /download. The file query parameter is concatenated into a filesystem path under the configured download directory without canonicalization or directory containment checks, allowing an authenticated attacker with network reachability to the Remote Access Server to request files outside the intended directory. The impact is bounded by the Android application sandbox and storage restrictions, typically limiting exposure to app-internal and app-specific external storage.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-26228 VideoLAN VLC for Android prior to version 3.7.0 contains a path traversal vulnerability in the Remote Access Server routing for the authenticated endpoint GET /downlo… https://www.cve.org/CVERecord?id=CVE-2026-26228
Post summary
The CVE-2026-26228 vulnerability is a path traversal flaw in VLC for Android’s Remote Access Server, affecting versions prior to 3.7.0.
CVE-2026-26228 Path Traversal in VideoLAN VLC for Android Remote Access Server Before 3.7.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-26228
Post summary
A path traversal vulnerability (CVE-2026-26228) affecting VideoLAN VLC for Android Remote Access Server before version 3.7.0 is disclosed, with no PoC, exploit, or patch details provided.