Janus WebRTC Server up to and including version 1.4.3 contains a path traversal vulnerability in the Record&Play plugin. An unauthenticated attacker can provide a record request with a filename containing path separators, causing the server to write files outside the configured recordings_path. The filenames can end in –audio.mjr, –video.mjr, or –data.mjr, which will be created or truncated in any directory the Janus process can write to. This flaw enables an attacker to place or modify arbitrary files on the host file system.

The vulnerability applies to any deployment of Meetecho’s Janus Gateway that runs version 1.4.3 or earlier and has the Record&Play plugin enabled. The attack does not require authentication and can be performed by send­ing a record request from any network accessible to the Janus server.

The CVSS base score of 6.9 indicates moderate to high severity. The EPSS score is reported as <1%, indicating a very low probability of exploitation, and the vulnerability is not currently listed in the CISA KEV catalog. An attacker would need only network access to the Janus service to trigger the flaw, making the risk significant for exposed instances even though the likelihood of successful exploitation is low.