Vulnerability · Published Feb 26, 2026 · Assigned by VulnCheck

CVE-2026-26228VLC for Android < 3.7.0 Remote Access Path Traversal

Medium 4.9

In plain English

A medium-severity path traversal in VLC for Android from VideoLAN. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 3.1)4.9Medium

Exploit odds (30 days)0.3%top 75.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

VideoLAN VLC for Android prior to version 3.7.0 contains a path traversal vulnerability in the Remote Access Server routing for the authenticated endpoint GET /download. The file query parameter is concatenated into a filesystem path under the configured download directory without canonicalization or directory containment checks, allowing an authenticated attacker with network reachability to the Remote Access Server to request files outside the intended directory. The impact is bounded by the Android application sandbox and storage restrictions, typically limiting exposure to app-internal and app-specific external storage.

Affected products (as reported)

Vendor	Product	Versions
VideoLAN	VLC for Android	0 – before 3.7.0

Weakness: CWE-22, CWE-73 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:L

References

https://www.videolan.org/vlc/download-android.html product
https://github.com/videolan/vlc-android/releases/tag/3.7.0 patch
https://www.vulncheck.com/advisories/vlc-for-android-remote-access-path-traversal third-party-advisory