CVE-2026-19829 in wvp-GB28181-pro
Summary
by MITRE • 08/14/2026
A security flaw has been discovered in 648540858 wvp-GB28181-pro 2.7.4-20260107. This vulnerability affects unknown code of the file LogController.java of the component Log File Download Endpoint. The manipulation of the argument fileName results in path traversal. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/14/2026
This vulnerability represents a critical path traversal flaw in the wvp-GB28181-pro 2.7.4-20260107 application, specifically within the LogController.java component that handles log file download operations. The issue stems from inadequate input validation of the fileName parameter, which allows attackers to manipulate directory traversal sequences such as ../ or ..\ to access files outside the intended log directory. This type of vulnerability falls under CWE-22 Path Traversal and aligns with ATT&CK technique T1059.007 for command and scripting interpreter usage in exploitation scenarios.
The technical implementation of this flaw occurs at the Log File Download Endpoint where user-supplied fileName arguments are directly incorporated into file system operations without proper sanitization or validation. When an attacker crafts a malicious fileName parameter containing path traversal sequences, the application processes these inputs without restricting access to files within the designated log directory structure. This allows unauthorized access to sensitive system files, configuration data, and potentially confidential information stored on the server.
The remote exploitation capability of this vulnerability presents significant operational risks for organizations deploying this software, particularly in environments where security cameras and video management systems are integrated with broader network infrastructure. Attackers can leverage publicly available exploits to traverse file system boundaries and potentially access sensitive log data, system configuration files, or even execute arbitrary code if the application has elevated privileges. The combination of remote attack vector with public exploit availability significantly increases the threat surface and potential impact of this vulnerability.
Organizations should implement immediate mitigations including input validation controls that sanitize all fileName parameters to prevent directory traversal sequences from being processed. The application should enforce strict file access controls that limit log file operations to predefined directories and reject any inputs containing path traversal characters or sequences. Additionally, implementing proper authorization checks and access controls around the Log File Download Endpoint will help prevent unauthorized access to sensitive system information. Regular security audits and code reviews focusing on input validation practices should be conducted to identify similar vulnerabilities in other components of the application.