CVE-2026-88623

Overview

NUUO Network Video Recorder 2.0.0 allows unauthenticated users to read arbitrary files via the up.php endpoint. By submitting a crafted URL in a POST request, attackers can download any file accessible to the web server. This flaw exposes sensitive data and system configuration.

Description

NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. In up.php, the url parameter submitted by the user via POST is received, and fopen() is used to open the URL in binary read-only mode. The content is then written to the /tmp/ directory, with the filename derived from basename() of the URL. This operation requires no authentication.

Impact

Confidentiality: attackers can exfiltrate arbitrary files, including credentials and configuration. Integrity: no direct modification but data exposure can lead to further attacks. Availability: not directly impacted. Defenders: system administrators and network security teams.

Remediation

Apply vendor patch or upgrade to a version that sanitizes the URL parameter and removes fopen() usage. If a patch is unavailable, disable the up.php endpoint or block POST requests to it via firewall or web server configuration. Additionally, restrict web server file permissions and disable file download from /tmp.

Risk context

High severity (CVSS 7.5) indicates significant risk. No EPSS data, but the flaw allows unauthenticated access, making it urgent for defenders to remediate.

Affected products

• NUUO Network Video Recorder 2.0.0