Vulnerability Description
WWBN AVideo before 29.5.0 contains a local file inclusion vulnerability that allows unauthenticated attackers to include PHP files outside the locale directory via a crafted Accept-Language header. Attackers can use overlapping traversal sequences like ....// to bypass single-pass removal in setLanguage(), executing existing server-side PHP files in the application context.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/WWBN/AVideo/commit/22e8c734ec89bb793d09dcc83f630e42d5fcaa8a
- https://github.com/WWBN/AVideo/releases/tag/v29.5.0
- https://github.com/WWBN/AVideo/security/advisories/GHSA-r3jc-85h3-h7g2
- https://www.vulncheck.com/advisories/wwbn-avideo-before-29.5.0-local-php-file-in
FAQ
What is CVE-2026-116800?
CVE-2026-116800 is a vulnerability with a CVSS score of 6.2 (MEDIUM). WWBN AVideo before 29.5.0 contains a local file inclusion vulnerability that allows unauthenticated attackers to include PHP files outside the locale directory via a crafted Accept-Language header. At...
How severe is CVE-2026-116800?
CVE-2026-116800 has been rated MEDIUM with a CVSS base score of 6.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-116800?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.