CVE-2026-110717: Janus WebRTC Server through 1.4.3 Path Traversal via Record&Play Filename
Janus WebRTC Server through 1.4.3 contains a path traversal vulnerability in the Record&Play plugin that allows unauthenticated attackers to write files outside recordingspath via the record request filename. Attackers can supply filenames with path separators to create or truncate files ending in -audio.mjr, -video.mjr or -data.mjr anywhere the Janus process can write outside protected folders.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Janus WebRTC Server deployments through version 1.4.3 are affected when the Record&Play plugin is available. The impact is limited by the filesystem permissions of the Janus process.
Does exploitation require authentication or user interaction?
No. The vulnerability can be exploited by an unauthenticated remote attacker, and no user interaction is required.
What filesystem changes can an attacker make?
An attacker can use path separators in a record request filename to write or truncate files outside recordings_path. The created or overwritten filename will end in -audio.mjr, -video.mjr, or -data.mjr, and must be in a location writable by the Janus process.