CVE-2026-7704: Pixera Two Media Server Path Traversal

CVE-2026-7704 Overview

CVE-2026-7704 is a path traversal vulnerability [CWE-22] affecting AV Stumpfl Pixera Two Media Server versions up to 25.1 R2. The flaw resides in an unspecified function exposed through the component listening on Service Port 1338. An attacker on an adjacent network can manipulate input to traverse directory boundaries and access files outside the intended scope. The vendor addressed the issue in version 25.2 R3. A proof-of-concept has been disclosed publicly, increasing the likelihood of opportunistic abuse against exposed installations.

Critical Impact
Adjacent network attackers can read files outside the application's intended directory through manipulation of the service listening on port 1338, potentially exposing configuration data on Pixera media server deployments.

Affected Products

AV Stumpfl Pixera Two Media Server versions up to and including 25.1 R2
Component: Service listening on Port 1338
Fixed in: AV Stumpfl Pixera 25.2 R3

Discovery Timeline

2026-05-03 - CVE-2026-7704 published to NVD
2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-7704

Vulnerability Analysis

The vulnerability is a path traversal weakness in the Pixera Two Media Server. The affected service listens on TCP port 1338 and processes requests that reference filesystem resources. The service fails to properly canonicalize or validate path input, allowing sequences such as ../ to escape the intended directory. An attacker positioned on the same logical network segment as the media server can issue crafted requests to retrieve files outside the application's working directory.

The Common Weakness Enumeration classifies this issue as [CWE-22] Improper Limitation of a Pathname to a Restricted Directory. The EPSS score is 0.017%, reflecting low predicted exploitation activity, though a public proof-of-concept exists on GitHub Gist.

Root Cause

The root cause is missing or insufficient validation of user-supplied path components within the Port 1338 service handler. The component accepts file references without normalizing the resulting path against an allow-listed base directory. Standard mitigations such as canonical path resolution and prefix verification were absent in versions through 25.1 R2.

Attack Vector

Exploitation requires network adjacency to the Pixera media server. No authentication and no user interaction are required. An attacker sends a crafted request to TCP port 1338 containing traversal sequences in a path parameter. The service resolves the manipulated path and returns content from arbitrary filesystem locations accessible to the service account. Public technical details are available in the GitHub Gist proof-of-concept and VulDB Vulnerability #360873.

Detection Methods for CVE-2026-7704

Indicators of Compromise

Inbound TCP connections to port 1338 on Pixera Two Media Server hosts originating from unexpected adjacent network sources
Request payloads containing traversal sequences such as ../, ..\, or URL-encoded variants like %2e%2e%2f
Access patterns referencing system files or configuration paths outside the Pixera installation directory

Detection Strategies

Inspect network traffic to TCP port 1338 for path traversal patterns using IDS signatures matching common traversal payloads
Correlate process telemetry on Pixera hosts with file read events for paths outside the expected media and configuration directories
Review application logs for malformed or unusually long path parameters submitted to the service

Monitoring Recommendations

Restrict and log all access to port 1338 at the network layer, alerting on connections from non-production VLANs
Monitor the Pixera service account for read operations targeting sensitive operating system paths
Track installed Pixera versions across the fleet and flag any host running 25.1 R2 or earlier

How to Mitigate CVE-2026-7704

Immediate Actions Required

Upgrade AV Stumpfl Pixera Two Media Server to version 25.2 R3 or later, which the vendor identifies as the fix release
Restrict network access to TCP port 1338 to trusted management hosts using host or perimeter firewall rules
Audit Pixera deployments for unauthorized file access events prior to applying the patch

Patch Information

AV Stumpfl resolved the path traversal in Pixera 25.2 R3. The fix is documented in the Pixera 25.2 changelog. Administrators should plan upgrades for all installations running 25.1 R2 and earlier. Additional vulnerability metadata is available in VulDB Vulnerability #360873.

Workarounds

Place Pixera servers on isolated production VLANs with strict ingress filtering to port 1338
Disable or block the affected service interface where the management functionality on port 1338 is not required for operations
Apply network segmentation that prevents general user workstations from reaching the media server adjacency

bash

# Example: restrict access to Pixera Service Port 1338 using iptables
iptables -A INPUT -p tcp --dport 1338 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 1338 -j DROP