CVE-2026-116800mediumCWE-22

CVE-2026-116800: medium-severity vulnerability in WWBN AVideo

WWBN AVideo before 29.5.0 Local PHP File Inclusion via Accept-Language Header

Published · Updated

Follow this CVE+ Monitor AVideo

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.9epss 0.5%
WWBN AVideo before 29.5.0 contains a local file inclusion vulnerability that allows unauthenticated attackers to include PHP files outside the locale directory via a crafted Accept-Language header. Attackers can use overlapping traversal sequences like ....// to bypass single-pass removal in setLanguage(), executing existing server-side PHP files in the application context.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
WWBN · AVideo
Related CVEs — WWBN AVideo

In the same product, most dangerous first.

CVE-2022-30690CRITICALCVE-2022-30690EPSS 83.9%CVE-2022-30534CRITICALCVE-2022-30534EPSS 75.0%CVE-2022-30547CRITICALCVE-2022-30547EPSS 63.7%CVE-2022-32572CRITICALCVE-2022-32572EPSS 24.1%CVE-2026-33478CRITICALAVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command InjectionEPSS 13.3%CVE-2023-32073HIGHAVideo command injection vulnerabilityEPSS 6.5%