VideoLAN VLC for Android models a Remote Access Server that offers a GET /download endpoint. The endpoint builds a local file system path by directly appending the file query parameter into the configured download directory without canonicalization or containment checks. An authenticated attacker who can reach the Remote Access Server can therefore retrieve files outside the intended download folder, although the Android application sandbox limits exposure to the app’s own internal or app‑specific external storage.

Any Android device running VLC for Android version earlier than 3.7.0 is vulnerable, regardless of other security settings. The vulnerability exists within the Android application bundle and does not affect native binaries or the underlying operating system.

The CVSS score of 2.3 indicates low overall severity, and the EPSS <1% suggests a very small likelihood of exploitation. The attack vector requires authentication and direct network access to the Remote Access Server, so only users who can log in to the app and have network reachability to the service can activate the attack. The vulnerability is not listed in CISA’s KEV catalog, so no publicly known exploits have been documented at this time.