CVE-2026-19829
Received Received - Intake

Path Traversal in wvp-GB28181-pro Log File Download

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: VulDB

Description
A security flaw has been discovered in 648540858 wvp-GB28181-pro 2.7.4-20260107. This vulnerability affects unknown code of the file LogController.java of the component Log File Download Endpoint. The manipulation of the argument fileName results in path traversal. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-19829
EUVD
EUVD-2026-58660

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
648540858 wvp-gb28181-pro 2.7.4-20260107

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a path traversal flaw in the wvp-GB28181-pro 2.7.4-20260107 software. It exists in the log download endpoint where the fileName parameter is used to construct a file path without proper validation. Attackers can manipulate this parameter to access files outside the intended directory by using sequences like ../.

Detection Guidance

Check for unusual file access patterns in logs, particularly requests to GET /api/log/file/{fileName} with suspicious fileName parameters containing sequences like ../. Monitor for authenticated users attempting to access files outside the intended log directory.

Impact Analysis

An attacker with valid authentication could read sensitive files on the system, such as configuration files, stored secrets, or system files like /etc/passwd. This could lead to credential disclosure and further compromise of the system.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection such as GDPR and HIPAA. Exposure of credentials or personal data may result in legal penalties and reputational damage.

Mitigation Strategies

Immediately restrict access to the log download endpoint. Implement path canonicalization to resolve file paths and validate fileName against an allowlist restricted to the log directory. Ensure proper authentication and authorization checks are enforced.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19829. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart