VITEC EZ TV PLATFORM SERVER · CVE-2026-82504 · Vendor
NO FIX YET · SEE WHAT TO DO
VITEC EZ TV Platform Server before 8.5.0 accepts file uploads from unauthenticated remote attackers, with the target filename taken from the X-FILENAME request header and no file type checks. An attacker can upload an ASPX file to the web-accessible uploads directory and run it on the server.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any organization running VITEC EZ TV Platform Server before 8.5.0 with its upload handler reachable from the internet. The flaw needs no account and no special setting, so exposed deployments are at risk; the sources do not say whether a managed or vendor-hosted deployment is affected.
Not affected if version-8.5.0-or-later
Who cares aspx, ez-tv-platform, iis, vitec, windows
8.5.0.aspx files8.5.0 or later8.3.0, 8.3.1, 8.4.0, and 8.4.1; releases before should upgrade to VITEC EZ TV Platform Server before 8.5.0 contains an unrestricted file upload vulnerability in the upload handler that allows unauthenticated remote attackers to upload arbitrary files by supplying a target filename in the X-FILENAME request header with no authentication or file type validation required. Attackers can upload a malicious ASPX file directly to the web-accessible uploads directory, where it is immediately executable by the web server, achieving remote code execution in the context of the web server process. Patches are available for versions 8.3.0, 8.3.1, 8.4.0, and 8.4.1. Users running releases prior to 8.3.0 should upgrade to 8.5.0+.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
8.3.08.5.0+