SECURITYCRITICALCVE-2026-82504

CVE-2026-82504: VITEC EZ TV Platform Server Unauthenticated File Upload (CVSS 9.8)

VITEC EZ TV Platform Server before 8.5.0 lets unauthenticated attackers upload arbitrary files via the X-FILENAME header. CVSS 9.8.

Dylan H.

Security Team

November 14, 2026
2 min read
CVE-2026-82504: VITEC EZ TV Platform Server Unauthenticated File Upload (CVSS 9.8)

Critical severity

Rated critical. Prioritise patching — see the remediation guidance below.

Affected Products

  • VITEC EZ TV Platform Server versions before 8.5.0

Summary

CVE-2026-82504 is an unrestricted file upload flaw in the VITEC EZ TV Platform Server. It was published to NVD on November 13, 2026 with a CVSS score of 9.8.

Details

Versions before 8.5.0 expose an upload handler that accepts a target filename in the X-FILENAME HTTP request header. The handler performs no authentication and no file type validation, so a remote attacker can write an arbitrary file to the server.

ItemDetail
CVECVE-2026-82504
CVSS9.8 (critical)
ProductVITEC EZ TV Platform Server
AffectedVersions before 8.5.0
Fixed in8.5.0
AuthenticationNone required

An unrestricted upload on a network-facing server typically leads to remote code execution if the attacker can place a script or executable in a location the server runs. The NVD description does not state whether that has been demonstrated here, and no public exploitation is listed in the feed data.

Recommended actions

  1. Upgrade EZ TV Platform Server to 8.5.0 or later.
  2. Remove the server from direct internet exposure; restrict access to trusted networks.
  3. Review web server logs for requests carrying an X-FILENAME header from unknown sources.
  4. Check upload directories for unexpected files, especially scripts or executables, and investigate any found.

References