CVE-2026-110717: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in meetecho janus-gateway

CVE-2026-110717 is a path traversal vulnerability in the Janus WebRTC Server (meetecho janus-gateway) through version 1.4.3. The vulnerability exists in the Record&Play plugin, where the filename parameter in record requests is not properly sanitized, allowing unauthenticated attackers to specify path separators and write files outside the designated recordings_path directory. This can lead to unauthorized file creation or truncation with filenames ending in -audio.mjr, -video.mjr, or -data.mjr in locations where the Janus process has write access.

An unauthenticated attacker can write or truncate files outside the intended recordings directory, potentially overwriting or creating files in arbitrary locations writable by the Janus process. This could lead to unauthorized modification of files, possibly affecting system integrity or availability depending on the files targeted. The vulnerability does not require privileges or user interaction and has a CVSS 4.0 base score of 6.9 (medium severity).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict file system permissions for the Janus process to limit writable directories and monitor for suspicious file creation or modification related to the Record&Play plugin.