CVE-2026-116800 | CVSS: 6.2 | 严重级别: MEDIUM
WWBN AVideo before 29.5.0 contains a local file inclusion vulnerability that allows unauthenticated attackers to include PHP files outside the locale directory via a crafted Accept-Language header. Attackers can use overlapping traversal sequences like ….// to bypass single-pass removal in setLanguage(), executing existing server-side PHP files in the application context.
参考链接:
• https://github.com/WWBN/AVideo/commit/22e8c734ec89bb793d09dcc83f630e42d5fcaa8a
• https://github.com/WWBN/AVideo/releases/tag/v29.5.0
• https://github.com/WWBN/AVideo/security/advisories/GHSA-r3jc-85h3-h7g2
📌 数据来源: NVD 官方
⚠️ 合规声明: 本文内容仅用于网络安全合规学习、科研与授权测试用途。严禁用于任何未授权行为,违者自行承担全部法律责任。