---
id: "CVE-2026-82504"
page: "https://infrastack.ai/live/CVE-2026-82504"
kind: "vulnerability"
aliases: ["CVE-2026-82504"]
title: "VITEC EZ TV Platform Server: unauthenticated file upload gives remote code execution"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "VITEC EZ TV Platform Server", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["aspx", "ez-tv-platform", "iis", "vendor", "vitec", "windows"]
not_affected_if: ["version-8.5.0-or-later"]
published_at: "2026-11-13T21:17:48+00:00"
first_seen_at: "2026-11-13T21:33:41+00:00"
updated_at: "2026-11-13T21:33:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82504", "first_seen_at": "2026-11-13T21:33:41+00:00"}]
exploit_sources: []
---

# VITEC EZ TV Platform Server: unauthenticated file upload gives remote code execution

Link for people: https://infrastack.ai/live/CVE-2026-82504 (this .md is for agents)

VITEC EZ TV Platform Server before 8.5.0 accepts file uploads from unauthenticated remote attackers, with the target filename taken from the X-FILENAME request header and no file type checks. An attacker can upload an ASPX file to the web-accessible uploads directory and run it on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:VITEC EZ TV Platform Server affected range not listed fixed no fixed version listed

## How to check

- Check the installed EZ TV Platform Server version against `8.5.0`
- Look in the web-accessible uploads directory for unexpected `.aspx` files

## Fix

- Move EZ TV Platform Server to `8.5.0` or later
- Patches are stated for `8.3.0`, `8.3.1`, `8.4.0`, and `8.4.1`; releases before `8.3.0` should upgrade to `8.5.0+`

## Timeline

- 2026-11-13T21:33:41+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-82504

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/vitec-ez-tv-platform-server-unauthenticated-file-upload-via-uploadhandler-ashx

## From the sources

VITEC EZ TV Platform Server before 8.5.0 contains an unrestricted file upload vulnerability in the upload handler that allows unauthenticated remote attackers to upload arbitrary files by supplying a target filename in the X-FILENAME request header with no authentication or file type validation required. Attackers can upload a malicious ASPX file directly to the web-accessible uploads directory, where it is immediately executable by the web server, achieving remote code execution in the context of the web server process. Patches are available for versions 8.3.0, 8.3.1, 8.4.0, and 8.4.1. Users running releases prior to 8.3.0 should upgrade to 8.5.0+.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_