CVE-2026-116800GHSA-r3jc-85h3-h7g2
WWBN AVideo before 29.5.0 Local PHP File Inclusion via Accept-Language Header
WWBN AVideo
CVSS
6.9MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 29.5.0AVideoCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
WWBN AVideo before 29.5.0 contains a local file inclusion vulnerability that allows unauthenticated attackers to include PHP files outside the locale directory via a crafted Accept-Language header. Attackers can use overlapping traversal sequences like ....// to bypass single-pass removal in setLanguage(), executing existing server-side PHP files in the application context.
Text from CVE List
Affected versions 2
- AVideoaffected: all versions before 29.5.0CVE List
- AVideounaffected: 29.5.0CVE List
References 4
- github.com/WWBN/AVideo/commit/22e8c734ec89bb793d09dcc83f630e42d5fcaa8aFixvia CVE List
- github.com/WWBN/AVideo/releases/tag/v29.5.0Fixvia CVE List
- github.com/WWBN/AVideo/security/advisories/GHSA-r3jc-85h3-h7g2Advisoryvia CVE List
- vulncheck.com/advisories/wwbn-avideo-before-29.5.0-local-php-file-inclusion-via-accept-language-headerAdvisoryvia CVE List