CVE-2026-110717 meetecho CVE debrief

Who should care

Defenders responsible for Janus WebRTC Server instances should assess exposure and prioritize updates or mitigations. System administrators and security teams overseeing WebRTC deployments need to verify their server versions and implement necessary security measures.

Why it matters

CVE-2026-110717 is a medium-severity path traversal vulnerability in Janus WebRTC Server's Record&Play plugin, allowing unauthenticated attackers to write files outside protected folders. Defenders should verify server versions, restrict write access, and monitor for suspicious activity to prevent potential data corruption or unauthorized file writes.

• Potential unauthorized file writes outside intended directories
• Possible data corruption or unauthorized file creation
• Risk of elevated privileges through careful file manipulation
• Need for verification of server version and exposure

Technical summary

The vulnerability exists in the Record&Play plugin of Janus WebRTC Server through version 1.4.3. An unauthenticated attacker can manipulate the filename in the record request to traverse the directory and write files outside the intended recordings_path. This can lead to the creation or truncation of files with specific extensions (-audio.mjr, -video.mjr, -data.mjr) in locations where the Janus process has write permissions, outside of protected folders.

Defensive priority

Defenders should prioritize verifying and updating Janus WebRTC Server instances to prevent potential unauthorized file writes.

Recommended defensive actions

• Verify Janus WebRTC Server version and update to a patched version if available
• Restrict write access to recordings_path and monitor for suspicious file modifications
• Implement additional security measures to prevent unauthorized file writes
• Conduct a thorough review of server configurations to identify potential exposure
• Perform vulnerability scanning to detect any instances of Janus WebRTC Server within the environment
• Review system logs for signs of potential exploitation
• Develop an incident response plan in case of a successful attack

Evidence notes

The vulnerability is confirmed in Janus WebRTC Server through version 1.4.3. The Record&Play plugin is affected, allowing unauthenticated path traversal attacks. The CVE record and source item provide details on the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.