Is CVE-2026-83526 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-83526 being exploited in the wild.

How severe is CVE-2026-83526?

High severity, with a CVSS score of 8.8, published 10 October 2026.

Which products and versions are affected?

FolioVision FV Player up to and including 8.1.7.

Is there a fix for CVE-2026-83526?

Yes: fixed in 8.1.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-83526 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-83526?

Check whether you run FolioVision FV Player at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-83526: FV Player arbitrary file upload via check_mimetype

CVE-2026-83526 · Severity: high · CVSS 8.8 · Published 2026-10-10

FV Player is a WordPress plugin that manages video playback on websites. The plugin has a vulnerability in its file upload function that allows authenticated users with low-level access (subscriber role) to upload executable files to the server, potentially leading to remote code execution. Exploitation requires winning a race condition but could give an attacker full control over the website.

Vendors: FolioVision.

Quick answers

Is CVE-2026-83526 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-83526 being exploited in the wild.
How severe is CVE-2026-83526?: High severity, with a CVSS score of 8.8, published 10 October 2026.
Which products and versions are affected?: FolioVision FV Player up to and including 8.1.7.
Is there a fix for CVE-2026-83526?: Yes: fixed in 8.1.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-83526 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-83526?: Check whether you run FolioVision FV Player at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 8.1.8

Technical details

The check_mimetype() function in FV Player 8.1.7 and earlier performs insufficient validation of uploaded files, writing attacker-supplied remote file content to the public uploads directory before any MIME type or extension checks are performed. Combined with a missing capability check on new player creation, authenticated users at subscriber level and above can exploit a race condition to upload executable files, enabling remote code execution.

Affected products

Foliovision FV Player up to and including 8.1.7

Timeline

2026-10-10: disclosed
2026-10-05: patched: Version 8.1.8 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.