CVE-2026-102875: VLC Media Player Path Traversal Vulnerability

CVE-2026-102875 Overview

CVE-2026-102875 is a path traversal vulnerability [CWE-22] affecting VLC media player versions before 3.0.24. The flaw resides in the skins2ThemeLoader component, which processes .vlt skin archives without validating member names contained in the archive. Attackers craft malicious skin files with directory traversal sequences to write arbitrary files with the privileges of the VLC user. The write primitive enables code execution when combined with Lua script injection into VLC's script directories.

Critical Impact
A user who opens a malicious .vlt skin file can be compelled into arbitrary file write and subsequent code execution under their own account, with high impact to confidentiality, integrity, and availability.

Affected Products

VLC media player versions prior to 3.0.24
VLC skins2 module ThemeLoader component (see modules/gui/skins2/src/theme_loader.cpp at tag 3.0.23)
All operating system builds of VLC that ship the skins2 interface

Discovery Timeline

2026-09-29 - CVE-2026-102875 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-102875

Vulnerability Analysis

VLC's skins2 interface loads user-supplied .vlt skin archives through the ThemeLoader class. During extraction, the loader iterates over member entries in the archive and writes each file to disk under VLC's skin directory. The loader fails to validate that member names remain confined to the intended output directory. As a result, an entry containing .. sequences or absolute path components escapes the extraction root.

The write primitive becomes code execution through Lua. VLC loads Lua scripts from well-known extension and interface directories at startup or on demand. An attacker who writes a .lua file into one of these directories through the traversal will have the script interpreted by VLC's embedded Lua runtime, running with the privileges of the user who opened the skin.

Root Cause

The root cause is missing input sanitization on archive member names inside ThemeLoader. Standard mitigations for archive extraction (canonicalizing member paths, rejecting absolute paths, and rejecting .. segments) were not applied prior to 3.0.24. Upstream commits 59934ed and 8d43e99 add member name validation and reject entries that resolve outside the destination directory. See the VLC Theme Loader source at tag 3.0.23 and the VulnCheck VLC path traversal advisory for technical details.

Attack Vector

Exploitation is local and requires user interaction. An attacker distributes a weaponized .vlt file through phishing, drive-by download, or a bundled software channel. When the victim opens the skin in VLC, the malicious archive drops a Lua payload into a script directory VLC will subsequently load. Any file writable by the current user is a valid target, including startup files that grant persistence.

The vulnerability is described in prose above. No verified proof-of-concept code is published;
readers can inspect the fix in the referenced upstream commits (59934ed and 8d43e99) to
understand the sanitization logic that was added around .vlt member name handling.

Detection Methods for CVE-2026-102875

Indicators of Compromise

Unexpected .lua files written under VLC data directories such as lua/extensions/, lua/intf/, or lua/playlist/ shortly after a .vlt file is opened.
.vlt archives whose internal member names contain ..\, ../, or absolute path prefixes.
Child processes spawned by vlc.exe or vlc immediately after skin load that are inconsistent with normal media playback.

Detection Strategies

File integrity monitoring on VLC skin and Lua script directories to flag new or modified script files not written by an installer.
Static inspection of .vlt archives at email and web proxies to reject archives with path traversal characters in member names.
Endpoint behavioral rules that correlate VLC opening an archive with subsequent writes outside the skins directory tree.

Monitoring Recommendations

Log process creation events with full command lines for vlc and monitor for unusual child processes such as shells or scripting hosts.
Alert on user-writable Lua script directories receiving files with recent modification times outside of application updates.
Track opening of .vlt files in application telemetry and correlate with file write events on the same host within a short window.

How to Mitigate CVE-2026-102875

Immediate Actions Required

Upgrade VLC media player to version 3.0.24 or later on all endpoints.
Block delivery of .vlt attachments at mail gateways until endpoints are patched.
Instruct users not to open skin files received from untrusted sources.
Inventory endpoints for VLC installs and prioritize patching of systems that regularly process untrusted media.

Patch Information

VideoLAN addressed the flaw in VLC 3.0.24. The relevant upstream fixes are commits 59934ed and 8d43e99 in the VLC Git repository, which add validation of archive member names in the skins2 ThemeLoader.

Workarounds

Disable the skins2 interface and use the default Qt interface until VLC can be updated.
Remove or restrict write access to the VLC Lua script directories for interactive user accounts where feasible.
Use application allowlisting to prevent VLC from loading Lua scripts from user-writable locations.

bash

# Launch VLC without the skins2 interface as a temporary workaround
vlc --intf qt --no-plugins-cache

# Verify installed VLC version meets the fixed release
vlc --version | head -n 1