CVE-2026-82504

VITEC EZ TV Platform Server Unauthenticated File Upload via UploadHandler.ashx

Assigner: VulnCheck
Reserved: 29.08.2026 Published: 13.11.2026 Updated: 13.11.2026

VITEC EZ TV Platform Server before 8.5.0 contains an unrestricted file upload vulnerability in the upload handler that allows unauthenticated remote attackers to upload arbitrary files by supplying a target filename in the X-FILENAME request header with no authentication or file type validation required. Attackers can upload a malicious ASPX file directly to the web-accessible uploads directory, where it is immediately executable by the web server, achieving remote code execution in the context of the web server process. Patches are available for versions 8.3.0, 8.3.1, 8.4.0, and 8.4.1. Users running releases prior to 8.3.0 should upgrade to 8.5.0+.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 9.3

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	High	Confidentiality	None
Attack Complexity	Low	Integrity	High	Integrity	None
Attack Requirements	None	Availability	High	Availability	None
Privileges Required	None
User Interaction	None

CVSS 4.0

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	VITEC
Product	EZ TV Platform Server
Versions	Default: unaffected affected from 0 to 8.5.0 (excl.) Version 8.5.0 is unaffected

Vendor

VITEC

Product

EZ TV Platform Server

Versions

Default: unaffected

affected from 0 to 8.5.0 (excl.)
Version 8.5.0 is unaffected

Solutions

All customers on an EZ TV Platform Server Version prior to 8.5.0 should contact the Vitec Helpdesk immediately to schedule patch or upgrade.

Credits

Daly Whyte (Solusec Ltd) finder

References

Problem Types

Unrestricted Upload of File with Dangerous Type CWE
Missing Authentication for Critical Function CWE