Bug 2571790 (CVE-2026-117373)

Summary: CVE-2026-117373 janus-gateway: janus-gateway: Arbitrary file disclosure via unvalidated media stream path
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in janus-gateway. This vulnerability allows an unauthenticated remote attacker to disclose arbitrary local files on the host system. By supplying a manipulated file path when initiating an on-demand stream, an attacker can bypass incomplete file extension checks due to a lack of directory restrictions and path sanitization. As a result, the server opens arbitrary files from the filesystem and broadcasts their contents to unauthorized listeners over Real-time Transport Protocol (RTP) audio.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-11 17:41:39 UTC 
Janus WebRTC Server 1.2.3 through 1.4.0 is vulnerable to Directory Traversal. The application accepts a caller supplied media path when an ondemand stream is created. The path is validated only by checking whether it contains one of the audio extensions and is then passed to the file source which opens it. No canonicalization is performed and no directory allowlist is enforced, so an unauthenticated caller can make the server open an arbitrary local file and use it as a media source, with the content delivered to viewers as RTP audio.