CVE-2026-19828 is a path traversal vulnerability in wvp-GB28181-pro version 2.7.4-20260107 affecting the Snapshot Endpoint component's PlayController.java file. The vulnerability is caused by improper validation of the deviceId/channelId argument, which can be manipulated remotely to traverse directories and potentially access unauthorized files. Public exploit code exists, but there is no information about an official patch or fix. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and low impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to perform path traversal attacks remotely, potentially leading to unauthorized access or modification of files on the affected system. The CVSS score of 6.3 reflects a medium impact on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected service and validate or sanitize inputs related to deviceId/channelId parameters to mitigate exploitation risk.