Description
WWBN AVideo before 29.5.0 contains a local file inclusion vulnerability that allows unauthenticated attackers to include PHP files outside the locale directory via a crafted Accept-Language header. Attackers can use overlapping traversal sequences like ....// to bypass single-pass removal in setLanguage(), executing existing server-side PHP files in the application context.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WWBN | AVideo | < 29.5.0 | 29.5.0 |
References
- GitHub Security Advisory (GHSA-r3jc-85h3-h7g2) vendor-advisory
- Patch Commit patch
- AVideo v29.5.0 Release Notes release-notes
- VulnCheck Advisory: WWBN AVideo before 29.5.0 Local PHP File Inclusion via Accept-Language Header third-party-advisory