CVE-2026-19828
Received Received - Intake

Path Traversal in wvp-GB28181-pro via Snapshot Endpoint

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: VulDB

Description
A vulnerability was identified in 648540858 wvp-GB28181-pro 2.7.4-20260107. This affects an unknown part of the file PlayController.java of the component Snapshot Endpoint. The manipulation of the argument deviceId/channelId leads to path traversal. The attack may be initiated remotely. The exploit is publicly available and might be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-19828
EUVD
EUVD-2026-58659

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
648540858 wvp-gb28181-pro 2.7.4-20260107

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-19828 is a path traversal vulnerability in the wvp-GB28181-pro project affecting the snapshot endpoint. It allows authenticated users to manipulate the deviceId parameter to write or overwrite arbitrary files on the media node by using path traversal sequences like ../ to escape the intended snapshot directory.

Detection Guidance

Check for unusual file writes in the snapshot directory by monitoring GET requests to /api/play/snap with manipulated deviceId or channelId parameters containing path traversal sequences like ../. Review logs for unauthorized file creation outside the intended directory.

Impact Analysis

This vulnerability could allow attackers to overwrite critical files on the media server's filesystem, potentially leading to unauthorized file modifications or system compromise. The impact is limited to file overwrite within the media node's filesystem using image data.

Mitigation Strategies

Update the wvp-GB28181-pro software to a patched version that canonicalizes file paths and validates input parameters. Restrict write permissions to the snapshot directory and implement strict input validation for deviceId and channelId parameters.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19828. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart