Vulnerability · Published Aug 14, 2026 · Assigned by VulDB

CVE-2026-19829648540858 wvp-GB28181-pro Log File Download Endpoint LogController.java path traversal

Medium 4.3

In plain English

A medium-severity path traversal in wvp-GB28181-pro from 648540858. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.5%top 59.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A security flaw has been discovered in 648540858 wvp-GB28181-pro 2.7.4-20260107. This vulnerability affects unknown code of the file LogController.java of the component Log File Download Endpoint. The manipulation of the argument fileName results in path traversal. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

Affected products (as reported)

Vendor	Product	Versions
648540858	wvp-GB28181-pro	2.7.4-20260107

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R

References

VDB-389965 | 648540858 wvp-GB28181-pro Log File Download Endpoint LogController.java path traversal vdb-entry, technical-description
VDB-389965 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-19829 | CVE Analysis and Report third-party-advisory
Submit #870241 | 648540858 wvp-GB28181-pro v2.7.4-20260107 Path Traversal third-party-advisory
https://github.com/648540858/wvp-GB28181-pro/issues/2176 exploit, issue-tracking
https://github.com/648540858/wvp-GB28181-pro/ product