CVE-2026-19829: 648540858 wvp-GB28181-pro Log File Download Endpoint LogController.java path traversal
A security flaw has been discovered in 648540858 wvp-GB28181-pro 2.7.4-20260107. This vulnerability affects unknown code of the file LogController.java of the component Log File Download Endpoint. The manipulation of the argument fileName results in path traversal. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.7.4-20260107 - Configuration
Validate and sanitize the fileName argument used by LogController.java to ensure it cannot traverse directories (e.g., block ../ and absolute paths) before using it to resolve the log file path.
LogController.java (Log File Download Endpoint) fileName = Reject/disable path traversal in fileName (do not allow traversal sequences such as ../ or absolute paths)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19829?
CVE-2026-19829 has a medium severity score of 4.3.
How do I fix CVE-2026-19829?
To mitigate CVE-2026-19829, ensure that input validation is implemented to prevent path traversal attacks when handling the fileName argument.
What kind of attack can be performed using CVE-2026-19829?
CVE-2026-19829 allows for path traversal attacks, enabling unauthorized access to files on the server.
Which component is affected by CVE-2026-19829?
CVE-2026-19829 affects the Log File Download Endpoint in the LogController.java file of the 648540858 wvp-GB28181-pro software.
When was CVE-2026-19829 published?
CVE-2026-19829 was published on August 14, 2026.