Path Traversal in VLC Media Player via Malicious Skin Files

Executive Summary

VLC media player before version 3.0.24 has a path traversal vulnerability in the skins2 ThemeLoader. It fails to validate member names in .vlt skin archives, allowing attackers to craft malicious skin files with path traversal sequences. This can write arbitrary files with VLC user privileges and enable code execution through Lua script injection.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your VLC version is before 3.0.24. On Linux, run 'vlc --version' in the terminal. On Windows, check the installed version via the Control Panel or run 'vlc --version' in Command Prompt. If the version is below 3.0.24, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to write malicious files to your system with the same privileges as your VLC user account. This could lead to arbitrary code execution, allowing the attacker to take control of your system or install malware.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update VLC to version 3.0.24 or later. Remove any untrusted .vlt skin files from your system. Avoid downloading skins from untrusted sources. Monitor for suspicious file writes or Lua script execution in user directories.

Useful 0 Not Useful 0