CVE-2026-7704

AV Stumpfl Pixera Two Media Server Service Port 1338 path traversal

View on CVE.org
Published May 3, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability has been found in AV Stumpfl Pixera Two Media Server up to 25.1 R2. The affected element is an unknown function of the component Service Port 1338. Such manipulation leads to path traversal. The exploit has been disclosed to the public and may be used. Upgrading to version 25.2 R3 is sufficient to fix this issue. It is advisable to upgrade the affected component.

Analysis

AI-generated

Technical impact

The vulnerability is a path traversal flaw in the Service Port 1338 element of AV Stumpfl Pixera Two Media Server up to version 25.1 R2. This allows an unauthenticated attacker to potentially read arbitrary files on the host. The flaw is categorized as CWE‑22, a directory traversal weakness, and carries a CVSS score of 5.3, indicating moderate severity. The exploit has been publicly disclosed, meaning threat actors may already be attempting to use it.

Affected Systems

The affected vendor is AV Stumpfl. Product Pixera Two Media Server versions up to 25.1 R2 are impacted, specifically the Service Port 1338 component. The documented fix is to upgrade to 25.2 R3 or later.

Risk and Exploitability

Although the EPSS score is not available, the public disclosure and moderate CVSS suggest attackers could readily exploit this flaw, especially on servers exposed to untrusted networks. The risk is present when the media server is reachable over the Internet or an unsecured internal network; an attacker would send a crafted request over port 1338 to traverse directories and retrieve sensitive files.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Pixera Two Media Server to version 25.2 R3 or later
  • Restrict inbound traffic on port 1338 to trusted IP addresses using firewalls or access control lists
  • If upgrading immediately is not possible, disable or isolate the Service Port 1338 service and ensure the server is not exposed to untrusted networks

Generated by OpenCVE AI on May 3, 2026 at 18:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Av Stumpfl
Av Stumpfl pixera Two Media Server
Vendors & Products Av Stumpfl
Av Stumpfl pixera Two Media Server
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability has been found in AV Stumpfl Pixera Two Media Server up to 25.1 R2. The affected element is an unknown function of the component Service Port 1338. Such manipulation leads to path traversal. The exploit has been disclosed to the public and may be used. Upgrading to version 25.2 R3 is sufficient to fix this issue. It is advisable to upgrade the affected component.
Title AV Stumpfl Pixera Two Media Server Service Port 1338 path traversal
Weaknesses CWE-22
References
Metrics cvssV2_0

{'score': 3.3, 'vector': 'AV:A/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
May 4, 2026, 1:04 PM
Reserved
May 2, 2026, 8:40 PM

View source JSON

Updated
May 4, 2026, 1:04 PM

JSON

Status
Deferred
Published
May 3, 2026, 5:16 PM
Modified
Oct 26, 2026, 12:10 AM

View source JSON

No data.

Updated
May 4, 2026, 4:06 PM

JSON