Description

A vulnerability was identified in 648540858 wvp-GB28181-pro 2.7.4-20260107. This affects an unknown part of the file PlayController.java of the component Snapshot Endpoint. The manipulation of the argument deviceId/channelId leads to path traversal. The attack may be initiated remotely. The exploit is publicly available and might be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-14T14:16:50.880Z",
  "pubdate": "2026-08-14T14:16:50.880Z",
  "executiveSummary": "A path traversal vulnerability has been identified in the Snapshot Endpoint component of 648540858 wvp-GB28181-pro version 2.7.4-20260107. Specifically, this security flaw resides within an unknown function in the file PlayController.java, where user-supplied input parameters are handled unsafely. The vulnerability allows remote attackers to manipulate the deviceId or channelId arguments, enabling unauthorized access to the underlying filesystem and arbitrary file retrieval outside the intended web root or storage directory. This flaw poses a severe risk to confidentiality, potentially exposing sensitive system or configuration files depending on the execution privileges of the Java process. The attack can be initiated remotely across the network without requiring complex preliminary interactions, and the public availability of exploit material significantly elevates the real-world exploitation risk. Organizations utilizing the affected software version must implement strict input validation and sanitization controls to prevent unauthorized directory traversal sequences within affected API endpoints.",
  "technicalDetails": "The vulnerability is classified as a path traversal flaw caused by insufficient sanitization and validation of user-controlled input within the Snapshot Endpoint of the wvp-GB28181-pro application. The root cause lies in the PlayController.java file, where parameters such as deviceId or channelId are directly processed and concatenated or utilized to construct file system paths for snapshot operations without adequately filtering directory traversal sequences, such as dot-dot-slash (../) patterns.\nExploitation of this vulnerability occurs remotely over the network when an unauthenticated or authenticated attacker sends a maliciously crafted HTTP request to the vulnerable Snapshot Endpoint handled by PlayController.java. By injecting directory traversal payloads into the deviceId or channelId parameters, the attacker forces the application to resolve file system paths outside of the designated secure storage directory. Consequently, the underlying Java Virtual Machine process reads or accesses arbitrary files on the host operating system that match the traversed path.\nThe attack flow follows a sequential pattern: 1) The attacker identifies the exposed Snapshot Endpoint governed by PlayController.java in 648540858 wvp-GB28181-pro 2.7.4-20260107. 2) The attacker crafts an HTTP request containing malicious traversal sequences encapsulated within the deviceId or channelId parameters. 3) The application receives the request and passes the unsanitized parameter directly to file system operations within the Java backend. 4) The operating system resolves the manipulated path, bypassing intended logical boundaries. 5) The contents of the targeted file are returned to the attacker through the HTTP response, resulting in unauthorized information disclosure.\nThe vulnerable component is explicitly the Snapshot Endpoint implemented within PlayController.java, affecting version 2.7.4-20260107 of 648540858 wvp-GB28181-pro. The network exposure is remote, allowing external adversaries to interact directly with the endpoint if accessible via the network interface. Post-exploitation impact is primarily centered on confidentiality loss, where sensitive system configurations, application data, or credentials stored on the host machine may be exfiltrated depending on the file read privileges associated with the running application instance."
}