This vulnerability exists in the Log File Download Endpoint of the 648540858 wvp-GB28181-pro product, specifically in version 2.7.4-20260107. The issue is due to insufficient validation of the fileName parameter in the LogController.java component, which enables an attacker to perform path traversal attacks remotely. This can potentially allow unauthorized access to files outside the intended directory. Public exploit code is available, but no official patch or remediation guidance has been provided by the vendor as of the published date.

Successful exploitation of this vulnerability could allow an attacker with low privileges to remotely access arbitrary files on the affected system by manipulating the fileName parameter. This may lead to unauthorized disclosure of sensitive information. However, the vulnerability does not require user interaction and has a medium CVSS score of 5.3, indicating moderate impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict access to the Log File Download Endpoint and monitor for any suspicious activity related to file access. Consider implementing input validation or filtering on the fileName parameter as a temporary measure.