CVE-2026-116800
WWBN AVideo before 29.5.0 Local PHP File Inclusion via Accept-Language Header
CVSS Score
6.2
EPSS Score
0.0%
EPSS Percentile
0th
WWBN AVideo before 29.5.0 contains a local file inclusion vulnerability that allows unauthenticated attackers to include PHP files outside the locale directory via a crafted Accept-Language header. Attackers can use overlapping traversal sequences like ....// to bypass single-pass removal in setLanguage(), executing existing server-side PHP files in the application context.
| CWE | CWE-22 |
| Vendor | wwbn |
| Product | avideo |
| Published | Oct 26, 2026 |
Stay Ahead of the Next One
Get instant alerts for wwbn avideo
Be the first to know when new medium vulnerabilities affecting wwbn avideo are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
WWBN / AVideo
0 < 29.5.0
References
github.com: https://github.com/WWBN/AVideo/security/advisories/GHSA-r3jc-85h3-h7g2 github.com: https://github.com/WWBN/AVideo/commit/22e8c734ec89bb793d09dcc83f630e42d5fcaa8a github.com: https://github.com/WWBN/AVideo/releases/tag/v29.5.0 vulncheck.com: https://www.vulncheck.com/advisories/wwbn-avideo-before-29.5.0-local-php-file-inclusion-via-accept-language-header
Credits
🔍 AlpetGexha