---
id: "CVE-2026-117373"
page: "https://infrastack.ai/live/CVE-2026-117373"
kind: "vulnerability"
aliases: ["CVE-2026-117373"]
title: "Janus WebRTC Server: media path traversal reads arbitrary local files"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "janus-gateway", "fixed": [], "affected": ">= 1.2.3, <= 1.4.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["janus", "runtime", "self-hosted", "streaming-plugin", "webrtc"]
not_affected_if: ["auth-required", "no-ondemand-streams", "on-demand-streams-disabled", "streaming-plugin-disabled", "version-outside-1.2.3-1.4.0"]
published_at: "2026-11-11T18:19:09+00:00"
first_seen_at: "2026-11-11T18:28:43+00:00"
updated_at: "2026-11-11T18:31:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117373", "first_seen_at": "2026-11-11T18:28:43+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-11T18:31:02+00:00"}]
exploit_sources: []
---

# Janus WebRTC Server: media path traversal reads arbitrary local files

Link for people: https://infrastack.ai/live/CVE-2026-117373 (this .md is for agents)

Janus WebRTC Server accepts a caller-supplied media path when an on-demand stream is created and only checks for an audio file extension. An attacker can make the server open any local file and stream its contents to viewers as audio.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:janus-gateway affected >= 1.2.3, <= 1.4.0 fixed no fixed version listed

## How to check

- Run janus --version; NVD range is 1.2.3 through 1.4.0 (vendor has not confirmed this range).
- Check janus.plugin.streaming.jcfg and any streams created at runtime: type = ondemand streams (local file streamed to one listener) are the exposed feature. If the streaming plugin is not loaded, you are likely not exposed.
- Also check if Janus is reachable by untrusted callers (HTTP/WebSocket API without tokens/secrets).

## Timeline

- 2026-11-11T18:28:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117373
- 2026-11-11T18:31:02+00:00 analyst — Release page v1.4.2 (linked as fix) shows only tag header; CHANGELOG for 1.4.1-1.4.3 has no entry for ondemand path traversal (nearest: 1.4.2 libcurl protocol allowlist in Streaming plugin). Fixed version unconfirmed; nothing verified. Check commit/advisories at github.com/meetecho/janus-gateway/security.

## Documents

- [fix] Release notes: github.com https://github.com/meetecho/janus-gateway/releases/tag/v1.4.2

## From the sources

Janus WebRTC Server 1.2.3 through 1.4.0 is vulnerable to Directory Traversal. The application accepts a caller supplied media path when an ondemand stream is created. The path is validated only by checking whether it contains one of the audio extensions and is then passed to the file source which opens it. No canonicalization is performed and no directory allowlist is enforced, so an unauthenticated caller can make the server open an arbitrary local file and use it as a media source, with the content delivered to viewers as RTP audio.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_