high
advisory
FV Flowplayer Video Player: PHP Object Injection (CVE-2026-118079)
FV Flowplayer Video Player versions 8.3.4 and earlier are affected by a PHP Object Injection vulnerability.
CVE search metadata
CVE search record: CVE-2026-118079. Severity: high. CVSS: 7.2. KEV: no. Product: FV Flowplayer Video Player (<= 8.3.4). Brief: FV Flowplayer Video Player: PHP Object Injection (CVE-2026-118079). Brief link: https://feed.craftedsignal.io/briefs/2026-10-fv-flowplayer-rce-223be8f0/
Triage facts
Revision 1- Applicability
- FV Flowplayer Video Player (<= 8.3.4)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Oct 29, 17:37 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
CVE-2026-118079 identifies a PHP Object Injection vulnerability in the FV Flowplayer Video Player plugin, affecting versions 8.3.4 and earlier.
Impact
Successful exploitation of PHP Object Injection vulnerabilities can lead to significant security risks, including potential data corruption or unauthorized code execution depending on the application environment.