# CVE-2026-83526: FV Player arbitrary file upload via check_mimetype

Source: https://junglewise.ai/threats/cve-2026-83526-the-fv-player-8-plugin-for-wordpress-is-vulnerable-to-arbitrary  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-10. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-83526 · Severity: high · CVSS 8.8 · Published 2026-10-10

FV Player is a WordPress plugin that manages video playback on websites. The plugin has a vulnerability in its file upload function that allows authenticated users with low-level access (subscriber role) to upload executable files to the server, potentially leading to remote code execution. Exploitation requires winning a race condition but could give an attacker full control over the website.

Vendors: [FolioVision](https://junglewise.ai/threats/vendors/foliovision).

## Quick answers

**Is CVE-2026-83526 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-83526 being exploited in the wild.

**How severe is CVE-2026-83526?** High severity, with a CVSS score of 8.8, published 10 October 2026.

**Which products and versions are affected?** FolioVision FV Player up to and including 8.1.7.

**Is there a fix for CVE-2026-83526?** Yes: fixed in 8.1.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-83526 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-83526?** Check whether you run FolioVision FV Player at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 8.1.8

## Technical details

The check_mimetype() function in FV Player 8.1.7 and earlier performs insufficient validation of uploaded files, writing attacker-supplied remote file content to the public uploads directory before any MIME type or extension checks are performed. Combined with a missing capability check on new player creation, authenticated users at subscriber level and above can exploit a race condition to upload executable files, enabling remote code execution.

## Affected products

- Foliovision FV Player up to and including 8.1.7

## Timeline

- 2026-10-10: disclosed
- 2026-10-05: patched: Version 8.1.8 released

## References

- [https://github.com/foliovision/fv-wordpress-flowplayer/releases/tag/8.1.8](https://github.com/foliovision/fv-wordpress-flowplayer/releases/tag/8.1.8)
- [https://plugins.trac.wordpress.org/browser/fv-player/trunk/controller/editor.php](https://plugins.trac.wordpress.org/browser/fv-player/trunk/controller/editor.php)

## Related threats

- [FV Player unauthenticated cross-site scripting](https://junglewise.ai/threats/cve-2026-42699-unauthenticated-cross-site-scripting-xss-in-fv-player-8-8-1-8)