CVE-2026-51134: C-MOR Video Surveillance Path Traversal

CVE-2026-51134 Overview

CVE-2026-51134 is a path traversal vulnerability in the C-MOR Video Surveillance web interface up to version 6.0104. The flaw resides in the cam parameter of the show-movies.pml script. Unauthenticated remote attackers can supply crafted input to traverse the filesystem and read files outside the intended directory. The issue is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. Public analysis of the flaw is available in the AlbCyberGuards CVE-2026-51134 Analysis.

Critical Impact

Unauthenticated attackers can read arbitrary files from the C-MOR appliance over the network, exposing surveillance footage, credentials, and system configuration.

Affected Products

• C-MOR Video Surveillance web interface versions up to and including 6.0104
• The vulnerable component is the show-movies.pml endpoint
• The affected parameter is cam

Discovery Timeline

• 2026-09-15 - CVE-2026-51134 published to the National Vulnerability Database
• 2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-51134

Vulnerability Analysis

The C-MOR Video Surveillance web interface exposes a script named show-movies.pml that accepts a cam parameter to select recorded footage by camera identifier. The application concatenates the supplied cam value into a filesystem path without validating or normalizing directory separators. An attacker can inject traversal sequences such as ../ to reach files outside the intended camera storage directory.

Because the endpoint does not require authentication and the attack originates over the network, exploitation requires no user interaction and no prior access. The result is a confidentiality-focused impact: attackers can retrieve arbitrary files readable by the web service account, including surveillance recordings, configuration files, and potentially credential material.

Root Cause

The root cause is missing input sanitization on the cam parameter. The handler in show-movies.pml fails to canonicalize the resulting path or restrict it to the intended base directory. Any request that includes directory traversal metacharacters is honored by the underlying file read operation, violating the [CWE-22] boundary constraint.

Attack Vector

Exploitation occurs over HTTP or HTTPS against the C-MOR web interface. An attacker issues a GET request to show-movies.pml with a cam value containing sequences such as ../../../../etc/passwd on Linux appliances. The server resolves the traversed path and returns the file contents in the response. No credentials, tokens, or CSRF prerequisites are required. Refer to the AlbCyberGuards CVE-2026-51134 Analysis for the request format used during validation.

No verified proof-of-concept code is reproduced here. See the linked external analysis for request examples.

Detection Methods for CVE-2026-51134

Indicators of Compromise

• HTTP requests to show-movies.pml containing ../, ..\, %2e%2e%2f, or other encoded traversal sequences in the cam parameter.
• Web server access logs showing successful 200 responses to show-movies.pml requests with unusually long or non-numeric cam values.
• Outbound file reads or responses referencing sensitive paths such as /etc/passwd, /etc/shadow, or C-MOR configuration files.

Detection Strategies

• Deploy web application firewall rules that reject cam parameter values containing directory traversal patterns, including URL-encoded and double-encoded variants.
• Baseline the expected format of the cam parameter (typically a short camera identifier) and alert on deviations in size, character set, or encoding.
• Correlate repeated 200 responses from show-movies.pml originating from a single external IP as potential enumeration of the filesystem.

Monitoring Recommendations

• Forward C-MOR web server access logs to a centralized logging or SIEM platform for retention and query.
• Monitor filesystem read activity on the C-MOR appliance for access to files outside the video storage directory.
• Track network egress from the C-MOR host for anomalous responses that suggest bulk file exfiltration.

How to Mitigate CVE-2026-51134

Immediate Actions Required

• Remove the C-MOR web interface from direct internet exposure and restrict access to trusted management networks or VPN users only.
• Review web server logs for prior requests to show-movies.pml containing traversal patterns and treat any matches as suspected compromise.
• Rotate credentials and secrets stored on the C-MOR appliance if log review indicates possible file disclosure.

Patch Information

Consult the C-MOR Video Surveillance Changelog for the fixed version released after 6.0104. Upgrade all affected appliances to the vendor-supplied release that addresses the cam parameter validation issue.

Workarounds

• Place the C-MOR web interface behind a reverse proxy or web application firewall that strips or rejects traversal characters in query parameters.
• Restrict access to the show-movies.pml endpoint by source IP using firewall or web server access control rules until the appliance is patched.
• Reduce the privileges of the account under which the C-MOR web service runs so that sensitive system files are not readable by the process.

# Example nginx reverse proxy rule to block traversal in the cam parameter
location /show-movies.pml {
    if ($arg_cam ~* "(\.\./|\.\.\\|%2e%2e)") {
        return 403;
    }
    proxy_pass http://cmor_backend;
}