# CVE-2026-102875: VLC media player path traversal in skins2 ThemeLoader

Source: https://junglewise.ai/threats/cve-2026-102875-vlc-media-player-before-3-0-24-contains-a-path-traversal  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-29. Updated: 2026-09-29  
License: CC BY 4.0 with a link back

CVE-2026-102875 · Severity: high · CVSS 7.8 · Published 2026-09-29

VLC media player, a widely-used multimedia application, contains a vulnerability in its skin loading system that allows attackers to write arbitrary files when a user opens a malicious skin file. An attacker can exploit this to run malicious code with the privileges of the user running VLC, potentially compromising the entire system or stealing sensitive data.

Technologies: [VideoLAN VLC media player](https://junglewise.ai/threats/technologies/vlc-media-player). Vendors: [VideoLAN](https://junglewise.ai/threats/vendors/videolan).

## Quick answers

**Is CVE-2026-102875 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102875 being exploited in the wild.

**How severe is CVE-2026-102875?** High severity, with a CVSS score of 7.8, published 29 September 2026.

**Which products and versions are affected?** VideoLAN VLC media player before 3.0.24.

**Is there a fix for CVE-2026-102875?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-102875 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-102875?** Check whether you run VideoLAN VLC media player at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a path traversal flaw in the skins2 ThemeLoader component that fails to properly validate member names when extracting .vlt skin archive files. An attacker can craft a malicious .vlt file containing path traversal sequences (e.g., ../) to write files outside the intended directory, including Lua scripts that VLC will execute. This requires user interaction to open the malicious skin file.

## Affected products

- VideoLAN VLC media player before 3.0.24

## Timeline

- 2026-09-29: disclosed

## References

- [https://code.videolan.org/videolan/vlc](https://code.videolan.org/videolan/vlc)
- [https://code.videolan.org/videolan/vlc/-/blob/3.0.23/modules/gui/skins2/src/theme_loader.cpp](https://code.videolan.org/videolan/vlc/-/blob/3.0.23/modules/gui/skins2/src/theme_loader.cpp)

## Related threats

- [VLC media player memory-safety vulnerability in network source handling](https://junglewise.ai/threats/cve-2026-73324-vlc-media-player-memory-safety-vulnerability-in-network-source)
- [VLC media player memory safety vulnerability](https://junglewise.ai/threats/cve-2026-56711-vlc-media-player-memory-safety-vulnerability)