An insecure API endpoint named locale accepts user supplied data and directly concatenates it into an include statement with no path validation or whitelist. Because directory traversal is permitted, an attacker can force the application to include any file under the web root. When the included file is a PHP script, the interpreter executes it, allowing the attacker to read server files and, if they can place a PHP file elsewhere in the file system, to run arbitrary code on the host. The vulnerability stems from improper input handling, exemplified by the CWE-22 and CWE-98 weaknesses.

The vulnerability affects the WWBN AVideo video platform, specifically all versions up to and including 26.0. No patched releases have been published at the time of this advisory, leaving installations of those versions vulnerable.

The CVSS score of 8.6 indicates a high severity impact, affecting confidentiality, integrity, and availability across the full application. The EPSS score is below 1 percent, suggesting the overall likelihood of exploitation in the broader ecosystem is low, and the vulnerability is not present in CISA’s Known Exploited Vulnerabilities catalog. Attackers gain access by sending an unauthenticated request to the locale endpoint; for full remote code execution they additionally need the ability to create or control a PHP file that the application can include. If these conditions are met, the attacker can compromise the entire hosting environment.