WWBN AVideo before 29.5.0 Local PHP File Inclusion via Accept-Language Header
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 29.5.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
WWBN AVideo, an open-source video platform, is affected by a flaw in how it handles the Accept-Language HTTP header. Unauthenticated attackers can exploit this to make the server load and run PHP files that already exist on the system, which could allow them to access sensitive data or take control of the application.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
WWBN AVideo before 29.5.0 contains a local file inclusion vulnerability that allows unauthenticated attackers to include PHP files outside the locale directory via a crafted Accept-Language header. Attackers can use overlapping traversal sequences like ....// to bypass single-pass removal in setLanguage(), executing existing server-side PHP files in the application context.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- WWBN AVideo
fixed in 29.5.0