VLC media player before version 3.0.24 is vulnerable to a path traversal flaw in the skins2 ThemeLoader component. The loader fails to validate member names within .vlt skin archives, allowing an attacker to craft a malicious skin file that contains path traversal sequences. When VLC loads such a skin, it writes arbitrary files to the local file system with the privileges of the user running VLC. Because VLC can execute Lua scripts embedded in skin files, this flaw can lead to local code execution by the user.

The affected product is VLC media player from VideoLAN, in all platforms, for all releases prior to 3.0.24. No additional version ranges are provided beyond the stated upper bound of 3.0.24.

The vulnerability has a CVSS score of 8.5, indicating high severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The attack vector is local: an attacker must supply a malicious skin file to a user who runs VLC. Once the user loads the skin, the attacker can write arbitrary files and execute Lua scripts, enabling arbitrary code execution with the user's privileges. Due to the local nature of the attack, exploitation is limited to systems where a user can be tricked or the attacker can directly provide a skin file.