CVE-2026-82504

CRITICAL 9.8

VITEC EZ TV Platform Server Unauthenticated File Upload via UploadHandler.ashx

CVSS Score

9.8

EPSS Score

0.0%

EPSS Percentile

0th

VITEC EZ TV Platform Server before 8.5.0 contains an unrestricted file upload vulnerability in the upload handler that allows unauthenticated remote attackers to upload arbitrary files by supplying a target filename in the X-FILENAME request header with no authentication or file type validation required. Attackers can upload a malicious ASPX file directly to the web-accessible uploads directory, where it is immediately executable by the web server, achieving remote code execution in the context of the web server process. Patches are available for versions 8.3.0, 8.3.1, 8.4.0, and 8.4.1. Users running releases prior to 8.3.0 should upgrade to 8.5.0+.

CWE	CWE-434 CWE-306
Vendor	vitec
Product	ez tv platform server
Published	Nov 13, 2026

Stay Ahead of the Next One

Get instant alerts for vitec ez tv platform server

Be the first to know when new critical vulnerabilities affecting vitec ez tv platform server are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

VITEC / EZ TV Platform Server

0 < 8.5.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vitec.com: https://www.vitec.com/dl/vitec-ez-tv-platform-datasheet vulncheck.com: https://www.vulncheck.com/advisories/vitec-ez-tv-platform-server-unauthenticated-file-upload-via-uploadhandler-ashx

Credits

Daly Whyte (Solusec Ltd)