Description

A security flaw has been discovered in 648540858 wvp-GB28181-pro 2.7.4-20260107. This vulnerability affects unknown code of the file LogController.java of the component Log File Download Endpoint. The manipulation of the argument fileName results in path traversal. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-14T14:16:51.153Z",
  "pubdate": "2026-08-14T14:16:51.153Z",
  "executiveSummary": "A path traversal vulnerability has been identified in 648540858 wvp-GB28181-pro version 2.7.4-20260107, specifically within the Log File Download Endpoint handled by LogController.java.\nThe security flaw arises from the improper sanitization or validation of the fileName argument supplied by users, which allows remote threat actors to traverse the directory structure and access arbitrary files stored on the underlying host operating system.\nThe impact of this vulnerability is significant, as it grants unauthorized remote entities the ability to read sensitive system files, application logs, configuration data, or other restricted resources, depending on the privilege level of the underlying Java process.\nThe risk implications are critical given that an exploit has already been released to the public, increasing the likelihood of automated scanning and active exploitation attempts by malicious actors.\nAttackers can launch this attack remotely across the network without requiring prior authentication or specialized privileges, provided they can reach the vulnerable endpoint.\nMitigation requires applying vendor-supplied patches, implementing strict input validation and normalization on file path parameters, and restricting file read operations to a tightly controlled, sandboxed directory.",
  "technicalDetails": "The vulnerability exists within the Log File Download Endpoint implemented in LogController.java of the 648540858 wvp-GB28181-pro 2.7.4-20260107 software package.\nThe root cause of the path traversal flaw is the direct acceptance and insecure concatenation of the fileName parameter into file I/O operations without adequate sanitization, canonicalization, or validation against directory boundary constraints.\nWhen a remote attacker supplies specially crafted strings containing directory traversal sequences such as dot-dot-slash (../) within the fileName argument, the underlying file retrieval mechanism fails to restrict the path resolution to the intended logging directory.\nThe attack flow proceeds as follows: First, the remote unauthenticated attacker crafts an HTTP request targeting the Log File Download Endpoint exposed by LogController.java. Second, the attacker injects path traversal sequences into the fileName parameter, attempting to navigate outside the designated storage root. Third, the application processes the tainted input and passes the resulting path directly to the file system API. Fourth, the operating system resolves the path, allowing access to arbitrary files outside the security boundary. Finally, the contents of the targeted file are returned in the HTTP response body to the attacker.\nNetwork exposure is fully remote, as the endpoint is accessible over the network interface hosting the wvp-GB28181-pro application.\nNo authentication or specific privilege levels are mentioned as prerequisites, meaning unauthenticated external entities can potentially trigger the flaw.\nPost-exploitation impact includes the unauthorized disclosure of sensitive data, potential leakage of credentials or internal configuration parameters, and further reconnaissance capabilities that could facilitate chained exploitation against the host environment."
}