{"id":"CVE-2026-117373","kind":"vulnerability","aliases":["CVE-2026-117373"],"related":[],"title":"Janus WebRTC Server: media path traversal reads arbitrary local files","description":"Janus WebRTC Server 1.2.3 through 1.4.0 is vulnerable to Directory Traversal. The application accepts a caller supplied media path when an ondemand stream is created. The path is validated only by checking whether it contains one of the audio extensions and is then passed to the file source which opens it. No canonicalization is performed and no directory allowlist is enforced, so an unauthenticated caller can make the server open an arbitrary local file and use it as a media source, with the content delivered to viewers as RTP audio.","summary":"Janus WebRTC Server accepts a caller-supplied media path when an on-demand stream is created and only checks for an audio file extension. An attacker can make the server open any local file and stream its contents to viewers as audio.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"janus-gateway","fixed":[],"affected":">= 1.2.3, <= 1.4.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["janus","runtime","self-hosted","streaming-plugin","webrtc"],"not_affected_if":["auth-required","no-ondemand-streams","on-demand-streams-disabled","streaming-plugin-disabled","version-outside-1.2.3-1.4.0"],"how_to_check":"- Run janus --version; NVD range is 1.2.3 through 1.4.0 (vendor has not confirmed this range).\n- Check janus.plugin.streaming.jcfg and any streams created at runtime: type = ondemand streams (local file streamed to one listener) are the exposed feature. If the streaming plugin is not loaded, you are likely not exposed.\n- Also check if Janus is reachable by untrusted callers (HTTP/WebSocket API without tokens/secrets).","fix":null,"status":"open","published_at":"2026-11-11T18:19:09+00:00","first_seen_at":"2026-11-11T18:28:43+00:00","triaged_at":"2026-11-11T18:29:48+00:00","updated_at":"2026-11-11T18:31:02+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-11-11T18:29:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Janus WebRTC Server: media path traversal reads arbitrary local files","impact":"medium","summary":"Janus WebRTC Server accepts a caller-supplied media path when an on-demand stream is created and only checks for an audio file extension. An attacker can make the server open any local file and stream its contents to viewers as audio.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["janus","webrtc","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Server reads arbitrary local files and streams them to viewers","analyst_note":"Confirm the fixed version and the exact setting for on-demand streams from the release notes at github.com before publishing a fix.","how_to_check":"- Check the installed Janus version with `janus --version` and compare it to the affected range 1.2.3 through 1.4.0.\n- Look for the ondemand stream (streaming plugin) being enabled in the Janus configuration.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-outside-1.2.3-1.4.0","on-demand-streams-disabled"],"who_is_affected":"Servers running Janus WebRTC Server versions 1.2.3 through 1.4.0 where the streaming plugin accepts on-demand stream creation. The request path is not authenticated per the description, so any reachable Janus instance is in scope. Teams not running these versions can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000741,"input_tokens":4628,"output_tokens":556,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm the fixed version and the exact setting for on-demand streams from the release notes at github.com before publishing a fix.","search":"'-117373':13A,16A '-2026':12A,15A '1.2.3':76C '1.4.0':78C 'accept':32B,86C 'allowlist':131C 'applic':85C 'arbitrari':8A,144C 'attack':56B 'audio':52B,72B,111C,162C 'caller':35B,88C,137C 'caller-suppli':34B 'canonic':125C 'check':49B,104C 'contain':107C 'content':68B,156C 'creat':46B,97C 'cve':11A,14A 'deliv':157C 'demand':43B 'directori':82C,130C 'enforc':133C 'extens':54B,112C 'file':10A,53B,64B,119C,146C 'gateway':19A 'host':24B 'janus':1A,18A,20B,29B,73C 'janus-gateway':17A 'local':9A,63B,145C 'make':58B,139C 'media':4A,37B,90C,152C 'on-demand':41B 'ondemand':94C 'one':108C 'open':61B,122C,142C 'pass':116C 'path':5A,38B,91C,99C 'perform':127C 'plugin':27B 'read':7A 'rtp':161C 'runtim':21B 'self':23B 'self-host':22B 'server':3A,31B,60B,75C,141C 'sourc':120C,153C 'stream':26B,44B,66B,95C 'streaming-plugin':25B 'suppli':36B,89C 'travers':6A,83C 'unauthent':136C 'use':148C 'valid':101C 'viewer':70B,159C 'vulner':80C 'webrtc':2A,28B,30B,74C 'whether':105C","nicknames":[],"mitigations":[],"who_affected":"Servers running Janus WebRTC Server versions 1.2.3 through 1.4.0 where the streaming plugin accepts on-demand stream creation. The request path is not authenticated per the description, so any reachable Janus instance is in scope. Teams not running these versions can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["janusgateway"],"ptokens":["gateway","janus"],"labels":["high","janus","runtime","selfhosted","streamingplugin","webrtc"],"campaign_type":null,"search_a":"'-117373':13A,16A '-2026':12A,15A 'arbitrari':8A 'cve':11A,14A 'file':10A 'gateway':19A 'janus':1A,18A 'janus-gateway':17A 'local':9A 'media':4A 'path':5A 'read':7A 'server':3A 'travers':6A 'webrtc':2A","search_b":"'accept':32B 'attack':56B 'audio':52B,72B 'caller':35B 'caller-suppli':34B 'check':49B 'content':68B 'creat':46B 'demand':43B 'extens':54B 'file':53B,64B 'host':24B 'janus':20B,29B 'local':63B 'make':58B 'media':37B 'on-demand':41B 'open':61B 'path':38B 'plugin':27B 'runtim':21B 'self':23B 'self-host':22B 'server':31B,60B 'stream':26B,44B,66B 'streaming-plugin':25B 'suppli':36B 'viewer':70B 'webrtc':28B,30B","search_c":"'1.2.3':76C '1.4.0':78C 'accept':86C 'allowlist':131C 'applic':85C 'arbitrari':144C 'audio':111C,162C 'caller':88C,137C 'canonic':125C 'check':104C 'contain':107C 'content':156C 'creat':97C 'deliv':157C 'directori':82C,130C 'enforc':133C 'extens':112C 'file':119C,146C 'janus':73C 'local':145C 'make':139C 'media':90C,152C 'ondemand':94C 'one':108C 'open':122C,142C 'pass':116C 'path':91C,99C 'perform':127C 'rtp':161C 'server':75C,141C 'sourc':120C,153C 'stream':95C 'suppli':89C 'travers':83C 'unauthent':136C 'use':148C 'valid':101C 'viewer':159C 'vulner':80C 'webrtc':74C 'whether':105C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T18:19:09+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117373","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117373","severity":null,"published_at":"2026-11-11T18:19:09+00:00","modified_at":"2026-11-11T18:19:09+00:00","first_seen_at":"2026-11-11T18:28:43+00:00","fetched_at":"2026-11-11T18:28:43+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-117373:3576","url":null,"severity":null,"published_at":"2026-11-11T18:31:02+00:00","modified_at":"2026-11-11T18:31:02+00:00","first_seen_at":"2026-11-11T18:31:02+00:00","fetched_at":"2026-11-11T18:31:02+00:00","note":"Release page v1.4.2 (linked as fix) shows only tag header; CHANGELOG for 1.4.1-1.4.3 has no entry for ondemand path traversal (nearest: 1.4.2 libcurl protocol allowlist in Streaming plugin). Fixed version unconfirmed; nothing verified. Check commit/advisories at github.com/meetecho/janus-gateway/security."}],"documents":[{"id":127734,"url":"https://github.com/meetecho/janus-gateway/releases/tag/v1.4.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}