---
id: CVE-2026-88623
title: NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read
summary: >-
  NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. In
  up.php, the url parameter submitted by the user via POST is received, and
  fopen() is used to open the URL in binary read-only mode. The content is then
  written to…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-552
published: '2026-09-18'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T19:43:52.337'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-88623'
references:
  - url: 'http://nuuo.com'
    label: cve@mitre.org
  - url: 'https://gist.github.com/4o3-f0rb1dd3n/b03b435a7c6730a0c9586bcc7967d9b5'
    label: cve@mitre.org
  - url: 'https://gist.github.com/4o3-f0rb1dd3n/b03b435a7c6730a0c9586bcc7967d9b5'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00499
epssPercentile: 0.40202
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-22T18:09:43.890488Z'
ingestedAt: '2026-09-18T14:43:13.055Z'
---

## Overview

NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. In up.php, the url parameter submitted by the user via POST is received, and fopen() is used to open the URL in binary read-only mode. The content is then written to the /tmp/ directory, with the filename derived from basename() of the URL. This operation requires no authentication.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.