Is there a public PoC exploit available for CVE-2026-19828?

Yes, a public proof-of-concept exploit is available for CVE-2026-19828. Prioritise patching immediately. EPSS: 0.3%.

wvp-GB28181-pro CVE-2026-19828

Q: What is the CVSS score of CVE-2026-19828?

CVE-2026-19828 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-58659 LOW

Path Traversal (CWE-22)

2026-08-14 VulDB

GHSA-fc89-v5qq-jw6x

Java Path Traversal Wvp Gb28181 Pro 648540858

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network endpoint requires low-privilege auth; path traversal yields partial read/write outside sandbox but no demonstrated availability impact or scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Aug 14, 2026 - 14:22 NVD

MEDIUM LOW

CVSS changed

Aug 14, 2026 - 14:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Aug 14, 2026 - 14:21 vuln.today

CVE Published

Aug 14, 2026 - 13:30 cve.org

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was identified in 648540858 wvp-GB28181-pro 2.7.4-20260107. This affects an unknown part of the file PlayController.java of the component Snapshot Endpoint. The manipulation of the argument deviceId/channelId leads to path traversal. The attack may be initiated remotely. The exploit is publicly available and might be used.

AnalysisAI

Path traversal in wvp-GB28181-pro 2.7.4-20260107 exposes arbitrary server files through the Snapshot Endpoint in PlayController.java, where the deviceId and channelId parameters are incorporated into file system operations without sanitization. Authenticated remote attackers with low-privilege access can escape the intended snapshot directory by injecting traversal sequences into these parameters, yielding partial confidentiality, integrity, and availability impact. A publicly available proof-of-concept exploit exists on GitHub (issue #2175), materially lowering the barrier to exploitation despite the moderate CVSS 5.3 score and absence from the CISA KEV catalog.

Technical ContextAI

wvp-GB28181-pro is a Java-based video surveillance management platform implementing the GB28181 Chinese national standard protocol for IP camera integration. The vulnerability resides in PlayController.java at the Snapshot Endpoint, where user-supplied values for the deviceId and channelId parameters are used in file system path construction without normalization or canonicalization. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) describes this root cause class - the failure to strip or reject sequences such as '../' before path resolution allows callers to escape the intended directory boundary. The affected CPE is cpe:2.3:a:648540858:wvp-gb28181-pro:*:*:*:*:*:*:*:*, with the wildcard version field suggesting the issue may extend beyond the specifically referenced build 2.7.4-20260107.

RemediationAI

No vendor-released patch with a confirmed fixed version has been identified at time of analysis - affected version range is based on NVD CPE data and the VulDB report at https://vuldb.com/vuln/389964. Monitor the upstream GitHub repository (https://github.com/648540858/wvp-GB28181-pro) and the GitHub issue tracker (https://github.com/648540858/wvp-GB28181-pro/issues/2175) for a fix. As compensating controls pending a patch: restrict network access to the Snapshot Endpoint via reverse proxy ACLs or firewall rules limiting callers to trusted IP ranges - this reduces effective attack surface but will block legitimate snapshot retrieval from other networks; deploy a web application firewall rule to reject requests containing path traversal patterns (e.g., '../', '%2e%2e') in the deviceId and channelId parameters; and harden server-side file system permissions on the snapshot directory so that the application process cannot read outside its intended scope, limiting the blast radius if traversal succeeds.