CVE-2023-47862 is a local file inclusion flaw in the getLanguageFromBrowser function of WWBN AVideo, found in the dev master commit 15fed957fb. NVD scores it 9.8, Critical. A crafted HTTP request can lead to arbitrary code execution. I could not confirm a fixed version, so update to the project's latest release.
What's affected
The record names WWBN AVideo at commit 15fed957fb of the dev master branch. It does not give a release number or a range, and it names no fixed version. The reference is a Cisco Talos report, TALOS-2023-1886, which blocked my automated request, so I could not read it. The facts here come from the NVD record.
The weakness is CWE-73, external control of file name or path. The NVD vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. No privileges or user interaction are needed. The description says an attacker can send a series of HTTP requests to trigger the flaw.
Because the record names a commit and not a release, you cannot match your install to a version number from the record alone. Look at the project's repository and its release notes to find the commit that changed the language handling. I will not guess at that commit.
How to check if you're exposed
Find out how your AVideo copy was installed. If you cloned the repository, check the commit with git:
git -C /path/to/avideo log -1 --format=%H
If you installed a release archive, read the version in the admin area and compare it with the project's release list. The record names a development commit, so a deployment that follows the master branch is the most likely to be affected.
Also check whether the site is reachable from the internet and whether it sits behind a web application firewall. The flaw needs only HTTP requests.
What to do now
- Update AVideo to the latest release or the latest commit of the project, and read the release notes for language handling fixes.
- Take a backup before updating, and test the upgrade on a copy first.
- Run the web server under an account with limited file system rights.
- Put the site behind a web application firewall or a reverse proxy that you control.
- Check web server logs for unusual requests to language related functions, and keep the logs.
Why it matters
A local file inclusion happens when an application builds a path from input and then loads that file as code. If the input can reach files the developer never meant to load, the server runs them. In PHP applications, that is a short step from reading a file to running code, which is why NVD rates the impact High across the board.
The weakness is CWE-73. The function name in the record, getLanguageFromBrowser, suggests that the input comes from a browser header or setting, which an attacker fully controls. The record does not say more, and neither will this post.
Open source video platforms are a common target because they are often installed once and left. If you run one, treat it as internet facing software that needs the same patching as any other service.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which AVideo release is fixed?
I could not confirm one. The record names only a development commit, so check the project's release notes.
Does the attacker need an account?
No. The NVD vector requires no privileges and no user interaction.
Sources
- Cisco Talos report TALOS-2023-1886 (cited in the record; access was blocked for me)
- Safeguard Gold page for CVE-2023-47862
Last reviewed: 19 October 2026.
