CVE-2026-19829
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
A security flaw in wvp-GB28181-pro version 2.7.4-20260107 affects unknown code in the file LogController.java of the Log File Download Endpoint. Manipulation of the argument fileName results in path traversal. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
Risk Assessment
The risk includes unauthorized access to files outside the intended directory, potentially leading to disclosure of sensitive information.
Recommendation
Immediately update wvp-GB28181-pro to a patched version and restrict access to the log endpoint.
Original NVD description (English source)
A security flaw has been discovered in 648540858 wvp-GB28181-pro 2.7.4-20260107. This vulnerability affects unknown code of the file LogController.java of the component Log File Download Endpoint. The manipulation of the argument fileName results in path traversal. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.