CVE-2026-88623: NUUO Network Video Recorder vulnerability
NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. In up.php, the url parameter submitted by the user via POST is received, and fopen() is used to open the URL in binary read-only mode. The content is then written to the /tmp/ directory, with the filename derived from basename() of the URL. This operation requires no authentication.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker who can send POST requests to the affected NUUO Network Video Recorder instance can exploit it. No login is required.
What access does an attacker need to read a file?
The attacker needs to control the url parameter sent to up.php. The application passes that value to fopen() in binary read-only mode, so exploitation depends on the server being able to open the supplied URL or path.
Where is the retrieved content stored?
The application writes the content it reads into the /tmp/ directory. The output filename is derived from the basename() of the supplied URL.