CVE-2026-19829CWE-22path-traversal

CVE-2026-19829

Medium · published August 14, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
39.2
In the wild
Unconfirmed
What it is

A security flaw has been discovered in 648540858 wvp-GB28181-pro 2.7.4-20260107. This vulnerability affects unknown code of the file LogController.java of the component Log File Download Endpoint. The manipulation of the argument fileName results in path traversal. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00467 · 39.2th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-08-14T18:16Z
References (6)
https://vuldb.com/cve/CVE-2026-19829 · [email protected]https://vuldb.com/submit/870241 · [email protected]https://vuldb.com/vuln/389965 · [email protected]https://vuldb.com/vuln/389965/cti · [email protected]https://github.com/648540858/wvp-GB28181-pro/ · [email protected]https://github.com/648540858/wvp-GB28181-pro/issues/2176 · [email protected]
EPSS history
Timeline
  • 14 AUG 13:45Z
    648540858 wvp-GB28181-pro Log File Download Endpoint LogController.java path traversal
    cvelistv5