CVE-2026-110717 in Janus Gateway
Summary
by MITRE • 10/15/2026
Janus WebRTC Server through 1.4.3 contains a path traversal vulnerability in the Record&Play plugin that allows unauthenticated attackers to write files outside recordings_path via the record request filename. Attackers can supply filenames with path separators to create or truncate files ending in -audio.mjr, -video.mjr or -data.mjr anywhere the Janus process can write outside protected folders.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified within Janus WebRTC Server versions through 1.4.3 represents a critical security flaw located specifically within the Record&Play plugin architecture. This component is responsible for handling media recording and playback operations, which are central to many real-time communication deployments utilizing this framework. The core technical deficiency lies in the insufficient validation of user-supplied input when processing filename parameters associated with record requests. Specifically, the application fails to sanitize or restrict path separators such as forward slashes or backslashes within the provided filename string before using it to construct file system paths for storing recorded media data. This lack of proper input sanitization allows an unauthenticated attacker to manipulate the intended directory structure by injecting relative path traversal sequences into the filename parameter.
From a technical perspective, this flaw constitutes a classic Path Traversal vulnerability, formally categorized under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. When a user initiates a recording session via the Janus API, they can specify a custom name for the resulting media files. The server processes this input by appending standard extensions such as -audio.mjr, -video.mjr, or -data.mjr to create the final file path. Because the application does not validate whether the supplied filename contains directory traversal characters, an attacker can supply a value like ../../etc/passwd-audio.mjr. The Janus process then interprets this input literally and attempts to write the recording data to that specified location on the underlying operating system's file system rather than within the designated recordings_path configuration directory.
The operational impact of this vulnerability is severe due to its unauthenticated nature, meaning no valid credentials are required to exploit it. An attacker can leverage this flaw to create or truncate arbitrary files anywhere in the file system where the Janus process has write permissions. This capability enables several malicious outcomes depending on the context and privileges of the service account running Janus. In a worst-case scenario, if the server is configured with elevated privileges, an attacker could overwrite critical system configuration files, inject web shells into directories served by other applications like Nginx or Apache, or disrupt services by deleting essential data files. Even in less privileged environments, the ability to create arbitrary files can lead to disk space exhaustion through log flooding or denial of service attacks, as well as potential information disclosure if sensitive files are overwritten with readable content that reveals internal system states.
This vulnerability aligns with MITRE ATT&CK technique T1048: Exfiltration Over Alternative Protocol and potentially T1562: Impair Defenses, depending on the specific exploitation method used to maintain persistence or evade detection. The ability to write files outside of restricted directories is a common precursor for more advanced attacks, including remote code execution if an attacker can place executable scripts in web-accessible locations that are subsequently executed by other services. It highlights the critical importance of strict input validation and path canonicalization in any service handling user-controlled file paths.
To mitigate this vulnerability, organizations running Janus WebRTC Server must immediately upgrade to version 1.4.4 or later, where the developers have implemented proper sanitization logic for filename inputs within the Record&Play plugin. Until an update can be applied, administrators should consider restricting the permissions of the user account under which the Janus process runs, ensuring it has write access only to the specific recordings directory and no other parts of the file system. Additionally, implementing a Web Application Firewall with rules designed to detect path traversal sequences in API parameters may provide a layer of defense-in-depth by blocking malicious requests before they reach the application logic. Regular security audits focusing on input validation practices across all plugins are also recommended to prevent similar issues from arising in other components of the server infrastructure.