CVE-2026-51134 in Video Surveillance
Summary
by MITRE • 09/15/2026
The C-MOR Video Surveillance web interface (up to version 6.0104) is vulnerable to Path Traversal via the 'cam' parameter in show-movies.pml.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified within the C-MOR Video Surveillance system, specifically affecting versions up through 6.0104, represents a critical security flaw rooted in improper input validation and path manipulation techniques. This specific weakness is classified under Common Weakness Enumeration as CWE-22, which denotes Improper Limitation of a Pathname to a Restricted Directory, commonly referred to as directory traversal or path traversal. The attack vector targets the show-movies.pml endpoint within the web interface, where the cam parameter serves as the primary point of entry for malicious actors. In secure software design, parameters that reference file systems should be strictly sanitized and validated against an allowlist of expected values or normalized paths to prevent access outside the intended directory structure. However, in this implementation, the application fails to adequately restrict the input provided via the cam parameter, allowing attackers to manipulate the path resolution logic.
By injecting specific sequences such as dot-dot-slash characters into the cam parameter, an attacker can traverse up through the server's file system hierarchy from the designated media directory. This manipulation enables the retrieval of arbitrary files stored on the underlying operating system that are not intended for public access via the web interface. The operational impact of this vulnerability is severe, particularly in a surveillance context where data integrity and confidentiality are paramount. Successful exploitation allows an unauthenticated or low-privileged user to read sensitive configuration files, source code, database credentials, or other private documents residing on the server. This exposure can lead to further compromise scenarios, including privilege escalation if credential files are accessed, or complete system takeover when combined with other vulnerabilities such as remote code execution flaws that might be discovered using information gleaned from these leaked files.
From a tactical perspective aligned with the MITRE ATT&CK framework, this vulnerability facilitates the Reconnaissance and Collection phases of an attack lifecycle. Specifically, it aligns with techniques related to File and Directory Discovery, where adversaries seek out sensitive data stored on local systems to support subsequent objectives such as Credential Access or Impact. The ability to read arbitrary files undermines the confidentiality aspect of the CIA triad and can serve as a stepping stone for more advanced persistent threats targeting critical infrastructure or private surveillance networks. Given that video surveillance systems often operate in isolated or semi-isolated network segments, this vulnerability could potentially be exploited by an insider threat or an attacker who has gained initial foothold through phishing or other entry points to pivot laterally and extract valuable intelligence from the system's file store.
Mitigation strategies must prioritize immediate patching of the C-MOR Video Surveillance software to version 6.0105 or higher, where this path traversal issue is resolved by implementing robust input validation mechanisms. Developers should enforce strict allowlisting for all parameters that interact with the file system, ensuring that only predefined and safe values are processed. Additionally, employing principle of least privilege for the web application process can limit the damage if exploitation occurs, restricting access to sensitive directories even if path traversal succeeds. Network-level controls such as Web Application Firewalls should be configured to detect and block common directory traversal patterns in HTTP requests targeting known vulnerable endpoints like show-movies.pml. Regular security audits and static code analysis focused on CWE-22 are recommended to prevent similar flaws from being introduced into future versions of the software, ensuring long-term resilience against path manipulation attacks.