Janus WebRTC Server CVE-2026-110717

Requires that the target Janus WebRTC Server (meetecho janus-gateway, versions through 1.4.3) be running with the Record&Play plugin loaded and its signaling API reachable by the attacker; the attacker then supplies a record-request filename containing path separators. No authentication is required (CVSS PR:N) and no user interaction is needed (UI:N). Exploitation is LIMITED by three factors: the created/truncated file must end in -audio.mjr, -video.mjr or -data.mjr (attacker does not control arbitrary filenames or file contents freely), the write only succeeds where the Janus process's OS user already has write permission and outside 'protected folders', and the Record&Play plugin must actually be enabled - deployments without that plugin are not affected.

This is a genuine but moderate-severity issue, not a top-tier emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms a network-reachable, low-complexity, unauthenticated vector requiring no user interaction - all signals that favor easy exploitation - and public exploit code exists (VulnCheck advisory plus a hackmd writeup), so the barrier to attack is low. However, the impact is deliberately constrained: the 4.0 vector sets VC:N/VI:L/VA:N, meaning only limited integrity impact and NO confidentiality or availability impact, which is why the score lands at 6.9 (Medium) rather than critical. The vulnerability writes or truncates files but only those ending in -audio.mjr, -video.mjr or -data.mjr and only where the Janus process already has write permission, which meaningfully limits the blast radius (it is not arbitrary-content file write or direct RCE). No EPSS score was provided in the input, so exploitation probability cannot be quantified here, and the CVE is NOT on the CISA KEV list, so there is no evidence of active in-the-wild exploitation despite POC availability - POC existence and active exploitation are distinct signals. Net: prioritize patching on internet-exposed Janus instances with the Record&Play plugin enabled, but treat it as an integrity/DoS-adjacent hardening fix rather than a wormable RCE.

An unauthenticated attacker reaches the Janus signaling API of an internet-exposed server with the Record&Play plugin enabled and issues a record request whose filename contains path-traversal sequences (e.g. ../../). Because the filename is not sanitized before being combined with recordings_path, the server creates or truncates a .mjr file outside the intended recordings directory anywhere the Janus process can write. Public exploit code is available (VulnCheck advisory and a hackmd proof-of-concept), lowering the effort required.