CVE-2026-19828

MediumCVSS 6.3

Published: 14/08/2026(UTC)Updated: 18/08/2026(UTC)Translated: 14/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

21th percentile - higher than 21% of all known CVEs

Summary

A vulnerability in wvp-GB28181-pro version 2.7.4-20260107 affects an unknown part of the file PlayController.java of the Snapshot Endpoint. Manipulation of the arguments deviceId/channelId leads to path traversal. The attack can be initiated remotely. The exploit is publicly available and might be used.

Risk Assessment

The risk includes unauthorized access to files outside the intended directory, potentially leading to disclosure of sensitive information.

Recommendation

Immediately update wvp-GB28181-pro to a patched version and validate deviceId/channelId arguments.

Original NVD description (English source)

A vulnerability was identified in 648540858 wvp-GB28181-pro 2.7.4-20260107. This affects an unknown part of the file PlayController.java of the component Snapshot Endpoint. The manipulation of the argument deviceId/channelId leads to path traversal. The attack may be initiated remotely. The exploit is publicly available and might be used.