JANUS-GATEWAY · CVE-2026-117373 · Runtime
NO FIX YET
Janus WebRTC Server accepts a caller-supplied media path when an on-demand stream is created and only checks for an audio file extension. An attacker can make the server open any local file and stream its contents to viewers as audio.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Servers running Janus WebRTC Server versions 1.2.3 through 1.4.0 where the streaming plugin accepts on-demand stream creation. The request path is not authenticated per the description, so any reachable Janus instance is in scope. Teams not running these versions can skip it.
Not affected if auth-required, no-ondemand-streams, on-demand-streams-disabled, streaming-plugin-disabled, version-outside-1.2.3-1.4.0
Who cares janus, self-hosted, streaming-plugin, webrtc
Unknown from the sources.
Janus WebRTC Server 1.2.3 through 1.4.0 is vulnerable to Directory Traversal. The application accepts a caller supplied media path when an ondemand stream is created. The path is validated only by checking whether it contains one of the audio extensions and is then passed to the file source which opens it. No canonicalization is performed and no directory allowlist is enforced, so an unauthenticated caller can make the server open an arbitrary local file and use it as a media source, with the content delivered to viewers as RTP audio.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.