CVE-2026-19828 in wvp-GB28181-pro
Summary
by MITRE • 08/14/2026
A vulnerability was identified in 648540858 wvp-GB28181-pro 2.7.4-20260107. This affects an unknown part of the file PlayController.java of the component Snapshot Endpoint. The manipulation of the argument deviceId/channelId leads to path traversal. The attack may be initiated remotely. The exploit is publicly available and might be used.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/14/2026
This vulnerability resides within the wvp-GB28181-pro 2.7.4-20260107 software system, specifically affecting the Snapshot Endpoint component in the PlayController.java file. The flaw represents a path traversal vulnerability that occurs when processing the deviceId and channelId arguments, creating an attack vector that allows unauthorized access to arbitrary files on the system. The vulnerability's classification aligns with CWE-22 Path Traversal and falls under the broader category of insecure direct object references as outlined in CWE-639. The attack surface is particularly concerning given that it can be initiated remotely without requiring authentication, making it accessible to any attacker who can reach the vulnerable service.
The technical exploitation occurs when malicious input is passed through the deviceId or channelId parameters, which are then processed without adequate validation or sanitization within the Snapshot Endpoint functionality. This allows attackers to manipulate file paths and potentially access sensitive system files, configuration data, or other resources that should remain restricted. The publicly available exploit further compounds the severity of this vulnerability, as it removes the requirement for sophisticated attack development and makes the flaw immediately actionable by threat actors. The path traversal mechanism enables attackers to navigate beyond intended directories and access files that may contain credentials, application logic, or system information.
Operationally, this vulnerability poses significant risks to organizations deploying wvp-GB28181-pro systems, particularly those managing video surveillance infrastructure where such systems are commonly implemented. The remote attack capability means that adversaries can exploit this flaw from outside the network perimeter, potentially leading to data exfiltration, system compromise, or further lateral movement within the network. Organizations relying on GB28181 protocol compliance for video management may face unauthorized access to surveillance footage and system configuration files, which could expose sensitive operational details. The impact extends beyond simple file access, as successful exploitation could enable attackers to gain insights into network architecture, potentially leading to more sophisticated attacks leveraging the stolen information.
Mitigation strategies should prioritize immediate patching of the affected software version to address the path traversal vulnerability in the Snapshot Endpoint implementation. Organizations should also implement proper input validation and sanitization measures for all parameters passed to file handling functions, particularly those related to device identification within surveillance systems. Network segmentation and access control measures should be strengthened to limit exposure of the vulnerable service to untrusted networks. Security monitoring should include detection of suspicious path traversal patterns in system logs, with particular attention to unusual file access requests through the snapshot endpoint. The remediation process must also consider implementing principle of least privilege controls for the application's file system access, ensuring that the service operates with minimal required permissions to reduce potential impact of successful exploitation attempts. Regular security assessments of third-party components and continuous monitoring for publicly disclosed vulnerabilities should be maintained to prevent similar issues from arising in future deployments.