Medium
6.9
WWBN AVideo before 29.5.0 contains a local file inclusion vulnerability that allows...
CVE-2026-116800
First seen on SecPulse
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| WWBN | AVideo |
< 29.5.0 |
29.5.0 |
Original description The description as published by the source.
WWBN AVideo before 29.5.0 contains a local file inclusion vulnerability that allows unauthenticated attackers to include PHP files outside the locale directory via a crafted Accept-Language header. Attackers can use overlapping traversal sequences like ....// to bypass single-pass removal in setLanguage(), executing existing server-side PHP files in the application context.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory