{"id":"CVE-2026-116800","title":"WWBN AVideo before 29.5.0 Local PHP File Inclusion via Accept-Language Header","summary":"WWBN AVideo before 29.5.0 contains a local file inclusion vulnerability that allows unauthenticated attackers to include PHP files outside the locale directory via a crafted Accept-Language header. Attackers can use overlapping traversal…","severity":"medium","cvss":6.2,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvssSource":"cna","cwe":["CWE-22"],"vendor":"WWBN","product":"AVideo","affected":["AVideo < 29.5.0"],"published":"2026-10-26","updated":"2026-10-26","sourceUpdated":"2026-10-26T23:05:33.044Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-116800","references":[{"url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-r3jc-85h3-h7g2","label":"GitHub Security Advisory (GHSA-r3jc-85h3-h7g2)"},{"url":"https://github.com/WWBN/AVideo/commit/22e8c734ec89bb793d09dcc83f630e42d5fcaa8a","label":"Patch Commit"},{"url":"https://github.com/WWBN/AVideo/releases/tag/v29.5.0","label":"AVideo v29.5.0 Release Notes"},{"url":"https://www.vulncheck.com/advisories/wwbn-avideo-before-29.5.0-local-php-file-inclusion-via-accept-language-header","label":"VulnCheck Advisory: WWBN AVideo before 29.5.0 Local PHP File Inclusion via Accept-Language Header"}],"tags":["cve.org"],"epss":0.00506,"epssPercentile":0.42977,"ingestedAt":"2026-10-27T16:11:59.142Z","slug":"CVE-2026-116800","body":"## Overview\n\nWWBN AVideo before 29.5.0 contains a local file inclusion vulnerability that allows unauthenticated attackers to include PHP files outside the locale directory via a crafted Accept-Language header. Attackers can use overlapping traversal sequences like ....// to bypass single-pass removal in setLanguage(), executing existing server-side PHP files in the application context.\n\n## Affected\n\n- `AVideo < 29.5.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":34.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}