CVE-2026-88623CWE-552

CVE-2026-88623

High · published September 18, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
41.9
In the wild
Unconfirmed
What it is

NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. In up.php, the url parameter submitted by the user via POST is received, and fopen() is used to open the URL in binary read-only mode. The content is then written to the /tmp/ directory, with the filename derived from basename() of the URL. This operation requires no authentication.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00499 · 41.9th percentile
Weakness
CWE-552 · Files or Directories Accessible to External Parties
Published
2026-09-18T18:19Z
References (3)
http://nuuo.com · [email protected]https://gist.github.com/4o3-f0rb1dd3n/b03b435a7c6730a0c9586bcc7967d9b5 · [email protected]https://gist.github.com/4o3-f0rb1dd3n/b03b435a7c6730a0c9586bcc7967d9b5 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 20 SEP 03:24Z
    EPSS moved — → 0%
    epss
  • 18 SEP 00:00Z
    NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read
    cvelistv5