We are seeing reports of a path traversal vulnerability affecting VLC for Android as of Feb 26, 2026. The issue is identified as CVE-2026-26228, and it impacts all versions < 3.7.0 of the app. Attackers can exploit the authenticated endpoint GET /download to retrieve files outside the intended download directory.
Severity and Technical Details
According to News Source, the vulnerability has a CVSS score of 2.3 (LOW). The discovery was reported by CVEFeed and confirmed independently by security analysts. Attackers concatenate the file query parameter into a filesystem path under the configured download directory without canonicalization or containment checks, allowing an authenticated attacker with network reachability to the Remote Access Server to request files outside the intended directory. This impact is bounded by the Android application sandbox and storage restrictions, typically limiting exposure to app-internal and app-specific external storage.
Who Should Be Concerned?
Most importantly, CISOs and system administrators should review any deployments of VLC for Android below version 3.7.0 in their enterprise or mid-market environments. Organizations that rely on media streaming services on Android devices may be at risk. Regulatory implications include potential breaches under GDPR if sensitive data is accessed inadvertently, and HIPAA concerns for healthcare apps.
Historical Context
Notably, similar path traversal vulnerabilities were discovered in VLC for Windows prior to version 3.0, illustrating a pattern of insecure handling of file paths across platforms. As a result, this vulnerability highlights the need for rigorous input validation across all software services.
Impact Assessment
Currently, an estimated millions of devices run VLC versions below 3.7.0 worldwide, and data at risk includes media files stored within the app’s sandbox. Attack progression scenarios involve attackers sending crafted URLs to the remote server, potentially exposing confidential media or personal data. Threat actor attribution is unclear but likely a low-budget exploit kit.
Immediate Actions Required
Immediately, apply the patch to VLC version 3.7.0 or later. The deadline for updating is within 24 hours if critical services are impacted; otherwise, within 72 hours for non-critical deployments. Verification steps include testing the GET /download endpoint with invalid file paths and confirming no traversal occurs. Alternative mitigations involve disabling remote access features until patching is completed. Detection guidance: monitor logs for unusual download requests and verify file path integrity.
Additional Resources
Additional resources: News Source – https://cvefeed.io/vuln/detail/CVE-2026-26228 provides detailed CVSS metrics, affected products, timeline, and more.
Get Expert Help
DefendMyBusiness Security Consultation: https://defendmybusiness.com/. Our solutions cover security advisory, voice, telecom expense management, and more.
Related security updates: Immediate Patch Needed for DoraCMS Path Traversal | ZenTaoPMS Directory Traversal Vulnerability – Immediate Patch Required | Belarusian KGB Seizes Persistent Mobile Access via ResidentBat Malware | OpenSSL Windows – Apply Patch Immediately
