WWBN AVideo EUVD-2026-110508

The HTTP Accept-Language path is reachable without authentication, account, privilege or user interaction when User_Location's default browser-based automatic language detection is active, or when the site falls back to the browser language. The inclusion primitive requires an existing, readable PHP file at a path reachable from locale/ via overlapping traversal ('....//'); the advisory did NOT demonstrate disclosure of secrets, arbitrary file-content reading, or a quantified availability impact. Key limiting factor: arbitrary attacker-supplied code execution additionally requires a separate, undemonstrated ability to place a PHP file at a reachable path, so realistic impact is bounded by which PHP files already exist in a given deployment. Note the supplied CVSS vector labels this AV:L, but the documented trigger is a remote HTTP header - verify the attack vector with the vendor.

Signals point to a real but moderate, context-dependent issue rather than a top-tier emergency. The decision label is 'this_month' (priority, not act_now/emergency), EPSS is low at 0.51% (43rd percentile), there is no CISA KEV listing, and no public exploit is identified - so widespread opportunistic exploitation is not indicated. The supplied CVSS 4.0 vector scores 6.9 but is internally inconsistent with the authoritative evidence in two ways that must be verified: (1) it sets AV:L (local), yet the GHSA confirms the flaw is triggered remotely via an unauthenticated HTTP Accept-Language header - the attack vector should be network, so the AV:L label appears wrong; (2) it asserts VC:H (high confidentiality), yet the maintainer's GHSA explicitly REMOVED an earlier CVSS 8.2/C:H vector because confidentiality impact was NOT demonstrated, and the validation did not establish secret disclosure, arbitrary file reading, or quantified availability impact. The maintainer's 'High' rating is a qualitative judgment grounded in the unauthenticated-inclusion primitive, not a demonstrated high-impact outcome. In practice the real impact is deployment-dependent: an attacker can only include EXISTING readable PHP files reachable from locale/, and turning that into arbitrary attacker-controlled code execution requires a separate, undemonstrated ability to plant a PHP file. Bottom line: credible unauthenticated reachability with uncertain, installation-specific impact - patch this month as the signals indicate, but the raw mechanism is lower real risk than a demonstrated unauthenticated RCE.

An unauthenticated attacker sends an HTTP request to an AVideo instance (version 29.3.0/29.4.0 or an unpatched source snapshot) with a crafted Accept-Language header such as '....//outside'; because setLanguage() applies only a single-pass str_replace('../',''), the overlapping sequence collapses to '../outside', and the loader's include_once executes an existing server-side PHP file outside locale/ in the application context. Reachability requires browser-based automatic language detection to be active or the site to fall back to the browser language. No public exploit code is identified; the advisory demonstrated the inclusion primitive only in an isolated local harness, and full attacker-controlled code execution would additionally require placing a PHP file at a reachable path, which was not demonstrated.