WWBN AVideo before version 29.5.0 is vulnerable to a local file inclusion flaw that can be triggered by an unauthenticated attacker sending a specially crafted Accept‑Language header. The header value is not properly sanitized and allows traversal sequences such as "../" to reference files outside the intended locale directory. If an existing PHP file is included, the attacker can execute that code within the context of the web application.

The vulnerability impacts installations of WWBN AVideo for all releases preceding 29.5.0. Versions 29.5.0 and later contain a patch that removes the insecure handling of the Accept‑Language header.

With a CVSS score of 6.9 the flaw presents medium severity. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog. The attack vector requires only the ability to send an HTTP request with a crafted Accept‑Language header and does not require authentication, making exploitation straightforward for an attacker who can reach the target over HTTP.