Local File Inclusion Vulnerability in WWBN AVideo Product

CVE-2026-116800

What is CVE-2026-116800?

The affected version of WWBN AVideo prior to 29.5.0 is susceptible to a local file inclusion vulnerability. This flaw allows unauthenticated attackers to exploit the application by manipulating the Accept-Language HTTP header to include PHP files located outside of the designated locale directory. By utilizing overlapping traversal sequences such as '....//', an attacker can bypass the single-pass removal checks present in the setLanguage() function. This exploitation can result in the execution of arbitrary server-side PHP scripts, leading to potential unauthorized access to sensitive application data or server configurations.

References