Is CVE-2026-26228 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-26228 being exploited in the wild.

How severe is CVE-2026-26228?

Medium severity, with a CVSS score of 4.9, published 26 February 2026.

Which products and versions are affected?

VideoLAN VLC for Android Prior to 3.7.0.

Is there a fix for CVE-2026-26228?

A patch was published on 2026-02-23: Version 3.7.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-26228 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-26228?

Check whether you run VideoLAN VLC for Android at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-26228: VideoLAN VLC for Android path traversal in Remote Access Server

CVE-2026-26228 · Severity: medium · CVSS 4.9 · Published 2026-02-26

VLC for Android, a popular media player app, contains a security flaw in its Remote Access Server feature. An authorized user on the same network could exploit this to access files on the device that they should not be able to see. While the impact is limited by Android's built-in security protections, it could still expose private application data or internal files.

Vendors: VideoLAN.

Quick answers

Is CVE-2026-26228 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-26228 being exploited in the wild.
How severe is CVE-2026-26228?: Medium severity, with a CVSS score of 4.9, published 26 February 2026.
Which products and versions are affected?: VideoLAN VLC for Android Prior to 3.7.0.
Is there a fix for CVE-2026-26228?: A patch was published on 2026-02-23: Version 3.7.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-26228 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-26228?: Check whether you run VideoLAN VLC for Android at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability exists in the Remote Access Server component of VLC for Android. The 'file' query parameter in the authenticated 'GET /download' endpoint is concatenated into a filesystem path without proper canonicalization or directory containment checks. An authenticated attacker with network reachability can exploit this to request files outside the designated download directory. The exploit's impact is restricted by the Android application sandbox, generally limiting file access to app-internal and app-specific external storage. The issue is resolved in version 3.7.0.

Affected products

VideoLAN VLC for Android Prior to 3.7.0

Timeline

2026-02-23: patched: Version 3.7.0 released
2026-02-26: advisory: Initial NVD publication

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.