C-MOR 6.0104 - Directory Traversal

C-MOR Video Surveillance up to version 6.0104 is vulnerable to a directory traversal flaw in the show-movies.pml web interface component. The vulnerability allows unauthenticated attackers to craft HTTP requests with directory traversal sequences in the 'cam' parameter to read arbitrary files on the server filesystem. The exploit has been publicly disclosed with CVE-2026-51134 and includes proof-of-concept code that retrieves sensitive files like /etc/passwd. The vendor has not yet provided an official patch or remediation instructions.

Successful exploitation permits unauthenticated attackers to read arbitrary files on the affected system, potentially exposing sensitive system information and configuration files. This unauthorized disclosure could facilitate further attacks or compromise confidentiality. There is no indication of remote code execution or other impacts. No active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the C-MOR web interface to trusted users only. Monitor HTTP requests for suspicious use of the 'cam' parameter containing directory traversal sequences to detect potential exploitation attempts.