CVE-2026-116800: WWBN AVideo before 29.5.0 Local PHP File Inclusion via Accept-Language Header

Q: Who can exploit this issue?

An unauthenticated attacker can exploit it remotely by sending a crafted Accept-Language HTTP header. The vulnerable language-selection path processes the header without requiring credentials.

Q: What is required for successful exploitation?

The attacker needs to craft an Accept-Language value containing overlapping traversal sequences such as ....// to bypass the single-pass removal in setLanguage(). Successful exploitation includes an existing server-side PHP file outside the locale directory in the application context.

Q: Which deployments are affected?

WWBN AVideo versions before 29.5.0 are affected. Because the vulnerable input is the standard Accept-Language header, deployments that expose the application to attacker-controlled HTTP requests are relevant.

Q: What should be done if immediate patching is not possible?

The provided data identifies version 29.5.0 as the release containing the fix. No alternative mitigation is specified in the available information.

Published Oct 26, 2026

Updated

WWBN AVideo before 29.5.0 contains a local file inclusion vulnerability that allows unauthenticated attackers to include PHP files outside the locale directory via a crafted Accept-Language header. Attackers can use overlapping traversal sequences like ....// to bypass single-pass removal in setLanguage(), executing existing server-side PHP files in the application context.

Affected Software

1 affected component

WWBN AVideo<29.5.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WWBN AVideo to a version that resolves this vulnerability.
Fixed in 29.5.0

Event History

Oct 26, 2026

CVE Published

via MITRE·11:05 PM

Data Sourced

via MITRE·11:05 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An unauthenticated attacker can exploit it remotely by sending a crafted Accept-Language HTTP header. The vulnerable language-selection path processes the header without requiring credentials.

What is required for successful exploitation?

The attacker needs to craft an Accept-Language value containing overlapping traversal sequences such as ....// to bypass the single-pass removal in setLanguage(). Successful exploitation includes an existing server-side PHP file outside the locale directory in the application context.

Which deployments are affected?

WWBN AVideo versions before 29.5.0 are affected. Because the vulnerable input is the standard Accept-Language header, deployments that expose the application to attacker-controlled HTTP requests are relevant.

What should be done if immediate patching is not possible?

The provided data identifies version 29.5.0 as the release containing the fix. No alternative mitigation is specified in the available information.

CVE-2026-116800: WWBN AVideo before 29.5.0 Local PHP File Inclusion via Accept-Language Header

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What is required for successful exploitation?

Which deployments are affected?

What should be done if immediate patching is not possible?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is required for successful exploitation?

Which deployments are affected?

What should be done if immediate patching is not possible?