CVE-2026-116800 in AVideo
Summary
by MITRE • 10/27/2026
WWBN AVideo before 29.5.0 contains a local file inclusion vulnerability that allows unauthenticated attackers to include PHP files outside the locale directory via a crafted Accept-Language header. Attackers can use overlapping traversal sequences like ....// to bypass single-pass removal in setLanguage(), executing existing server-side PHP files in the application context.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified in WWBN AVideo versions prior to 29.5.0 represents a critical local file inclusion flaw rooted in improper input validation within the language selection mechanism. This security defect allows unauthenticated remote attackers to manipulate the Accept-Language HTTP header to inject malicious path traversal sequences, specifically utilizing overlapping patterns such as ....// to evade basic sanitization logic. The core technical failure lies in the setLanguage function, which processes user-supplied locale identifiers without adequately normalizing or restricting file paths before inclusion. By employing redundant dot-slash combinations, attackers can bypass single-pass removal filters that are designed to strip out directory traversal characters like ../ and ..\ . This evasion technique exploits the sequential nature of string processing where each pass removes one instance of the malicious sequence, leaving residual path components that ultimately resolve to arbitrary files on the server's file system.
From a technical perspective, this vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory and CWE-94: Server-Side Code Injection. The attacker leverages these weaknesses to force the PHP interpreter to execute code from files located outside the intended locale directory structure. Since AVideo relies on dynamic inclusion for language packs, successfully exploiting this flaw grants the ability to include any readable file accessible by the web server process. If an attacker can locate a configuration file containing database credentials or other sensitive data, they may extract that information directly through the output of the included script. More critically, if writable files exist within reach or if existing PHP scripts with malicious payloads are present on the system, the inclusion mechanism allows for arbitrary code execution in the context of the web server user account.
The operational impact of this vulnerability is severe due to its unauthenticated nature and potential for remote exploitation via standard HTTP requests. An attacker does not need valid credentials to initiate the attack, significantly lowering the barrier to entry for malicious actors. Successful exploitation can lead to full system compromise, data exfiltration, or defacement of the application interface depending on what files are included and executed. This aligns with MITRE ATT&CK technique T1059: Command and Scripting Interpreter, as it facilitates the execution of arbitrary commands through PHP functions triggered by the inclusion process. The ability to read sensitive configuration files also maps to T1530: Data from Cloud or Storage Service if such data is stored locally in accessible formats, posing a direct threat to confidentiality and integrity.
Mitigation strategies must prioritize immediate patching to version 29.5.0 or later where the setLanguage function has been hardened against path traversal attacks. In addition to updating software, administrators should implement strict input validation that normalizes paths using canonicalization libraries rather than relying on simple string replacement for removing dot sequences. Web Application Firewalls can be configured with rules specifically targeting Accept-Language headers containing suspicious patterns like ....// or excessive ../ sequences. Furthermore, adhering to the principle of least privilege by restricting the web server's file system permissions ensures that even if an inclusion occurs, the attacker cannot access critical configuration files or execute arbitrary scripts outside the designated application directory. Regular security audits and static code analysis should be employed to detect similar logic flaws in other input-handling functions within the application.