Path Traversal Vulnerability in Janus WebRTC Server Record&Play Plugin
CVE-2026-110717

6.9MEDIUM

Key Information:

Vendor

Meetecho

Status
Janus-gateway
Vendor
CVE Published:
14 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-110717?

The Janus WebRTC Server, through version 1.4.3, is susceptible to a path traversal vulnerability identified in the Record&Play plugin. This flaw permits unauthenticated attackers to manipulate file paths and write files outside the intended recordings_path directory via specially crafted filenames. By utilizing path separators, adversaries can create or truncate files with extensions such as -audio.mjr, -video.mjr, or -data.mjr, potentially exposing sensitive data or compromising system integrity when the Janus process executes outside designated protected directories.

Affected Version(s)

janus-gateway 0 <= 1.4.3

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-110717 - Proof of Concept

References

https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/HkEaF-piGl
technical-descriptionexploit
https://github.com/meetecho/janus-gateway/blob/1f0b75cac1...
technical-description
https://github.com/meetecho/janus-gateway/blob/1f0b75cac1...
technical-description

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
.