CVE-2026-82504

VITEC EZ TV Platform Server before 8.5.0 contains an unrestricted file upload vulnerability in the upload handler that allows unauthenticated remote attackers to upload arbitrary files by supplying a target filename in the X-FILENAME request header with no authentication or file type validation required. Attackers can upload a malicious ASPX file directly to the web-accessible uploads directory, where it is immediately executable by the web server, achieving remote code execution in the context of the web server process. Patches are available for versions 8.3.0, 8.3.1, 8.4.0, and 8.4.1. Users running releases prior to 8.3.0 should upgrade to 8.5.0+.

• CWE-306
• CWE-434

• https://www.vitec.com/dl/vitec-ez-tv-platform-datasheet
• https://www.vulncheck.com/advisories/vitec-ez-tv-platform-server-unauthenticated-file-upload-via-uploadhandler-ashx

Published

Nov 13, 2026

Last Modified

Nov 13, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-82485A vulnerability has been found in itsourcecode Sales and Inv…6.3
• CVE-2026-82486A vulnerability was found in SiteServer SSCMS 7.4.0. Affecte…5
• CVE-2026-82487A vulnerability was determined in Beetel 450TC3 01.00.00_01.…6.3
• CVE-2026-82488A vulnerability was identified in Beetel 450TC3 01.00.00_01.…3.5
• CVE-2026-8249A flaw has been found in Open5GS up to 2.7.7. The impacted e…6.5
• CVE-2026-8250A vulnerability has been found in Open5GS up to 2.7.7. This …6.5
• CVE-2026-82509V programming language standard library net.http through ver…7.4
• CVE-2026-8251A vulnerability was found in Open5GS up to 2.7.7. This impac…6.5
• CVE-2026-82514Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-82518Akamai CLI before 2.0.6 contains a path traversal vulnerabil…6.5
• CVE-2026-82519Really Simple Security plugin for WordPress before 9.8.2 con…4.3
• CVE-2026-8252A vulnerability was determined in Open5GS up to 2.7.7. Affec…6.5