CVE-2026-116800 — Vulnerability intelligence

—

Published: 2026-10-27T00:17:11.070

CVSS

6.9

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

WWBN AVideo before 29.5.0 contains a local file inclusion vulnerability that allows unauthenticated attackers to include PHP files outside the locale directory via a crafted Accept-Language header. Attackers can use overlapping traversal sequences like ....// to bypass single-pass removal in setLanguage(), executing existing server-side PHP files in the application context.

Sources

• CVE-2026-116800
• Original advisory
• Original advisory
• Original advisory
• Original advisory