CVE-2026-26228 is a path traversal vulnerability (CWE-22) in VideoLAN VLC for Android before version 3.7.0. The vulnerability occurs in the Remote Access Server routing for the authenticated GET /download endpoint, where the file query parameter is concatenated into a filesystem path without canonicalization or directory containment checks. This allows an authenticated attacker with network reachability to the Remote Access Server to access files outside the configured download directory. The impact is constrained by Android sandboxing and storage permissions, limiting file access to areas controlled by the app.

An authenticated attacker with network access to the VLC Remote Access Server can exploit this vulnerability to read files outside the intended download directory. However, the impact is limited by Android's sandboxing and storage restrictions, which typically restrict access to app-internal and app-specific external storage areas. This reduces the potential for broader system compromise or access to sensitive user files outside the app's storage scope.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the Remote Access Server and ensure only trusted users have authenticated access. Monitor for vendor updates and apply official patches once released.