Live › vulnerability › CVE-2026-116800
Go to dashboardWWBN AVideo before 29.5.0 has a local file inclusion flaw in setLanguage(): a crafted Accept-Language header with overlapping traversal sequences such as ....// bypasses the single-pass path filter. An unauthenticated attacker can make the application include and execute existing PHP files on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 00:25 UTC. All times on this page are UTC.
Any AVideo installation older than 29.5.0 that accepts requests from the internet is exposed, because setLanguage() reads the Accept-Language header on ordinary page requests without requiring a login. Installations behind a firewall limited to trusted users are at lower risk but should still upgrade. Teams not running AVideo can skip it.
No product ranges from the sources yet.
29.5.0 are exposed.29.5.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
WWBN AVideo before 29.5.0 contains a local file inclusion vulnerability that allows unauthenticated attackers to include PHP files outside the locale directory via a crafted Accept-Language header. Attackers can use overlapping traversal sequences like ....// to bypass single-pass removal in setLanguage(), executing existing server-side PHP files in the application context.
This page as .md · .json · in your agent: get_signal("CVE-2026-116800")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.