CVE-2026-88623: NUUO Network Video Recorder File Read Flaw

CVE-2026-88623 Overview

CVE-2026-88623 is an arbitrary file read vulnerability in NUUO Network Video Recorder 2.0.0. The flaw resides in the up.php endpoint, which accepts a user-supplied url parameter via POST and passes it directly to fopen() in binary read-only mode. The retrieved content is then written to /tmp/ using a filename derived from basename() of the supplied URL. The operation requires no authentication, allowing unauthenticated remote attackers to read arbitrary files accessible to the web server process. The weakness is categorized under [CWE-552: Files or Directories Accessible to External Parties].

Critical Impact
Unauthenticated remote attackers can retrieve arbitrary files reachable through PHP's fopen() wrappers, exposing sensitive system data on affected NUUO NVR devices.

Affected Products

NUUO Network Video Recorder 2.0.0
Deployments exposing the up.php endpoint to untrusted networks
Installations running the vulnerable PHP handler without authentication controls

Discovery Timeline

2026-09-18 - CVE-2026-88623 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-88623

Vulnerability Analysis

The vulnerability exists in the up.php script shipped with NUUO Network Video Recorder 2.0.0. The script accepts a url POST parameter and passes the value directly to PHP's fopen() function with a binary read-only mode flag. Because PHP's fopen() supports multiple stream wrappers, including file://, http://, ftp://, and php://, the parameter can reference local filesystem paths in addition to remote resources. The handler then reads the contents and writes them into /tmp/ using a filename computed by basename() of the input URL.

No authentication or session validation gates access to this endpoint. Any network-reachable attacker can invoke it directly and stage arbitrary readable files inside a predictable temporary directory. Because the copied file resides in /tmp/ with a known basename, attackers can subsequently retrieve it through other exposed handlers or use it to seed follow-on attacks.

Root Cause

The root cause is unsanitized user input passed to a file-opening primitive without path validation, scheme restriction, or authentication. The basename() transformation only strips directory components from the destination filename; it does not constrain the source URL, so any file readable by the web server user can be exfiltrated to /tmp/.

Attack Vector

Exploitation occurs over the network by issuing an unauthenticated HTTP POST request to up.php with the url parameter set to a local file path such as file:///etc/passwd or a similarly sensitive resource. The web server retrieves the referenced content and stores it under /tmp/ using the basename derived from the URL. Attackers can then read the staged file through any accessible retrieval path on the device. Additional technical detail is documented in the GitHub Security Gist.

Detection Methods for CVE-2026-88623

Indicators of Compromise

Unauthenticated POST requests to /up.php containing a url parameter
Requests with url values using file://, php://, or other non-HTTP stream wrappers
Unexpected files appearing in /tmp/ whose names match the basename of remote or local URLs
Repeated up.php requests from a single external source enumerating filesystem paths

Detection Strategies

Inspect web server access logs for POST requests to up.php and correlate with source IP reputation
Alert on request bodies containing scheme identifiers such as file:, php:, or absolute filesystem paths
Monitor filesystem writes to /tmp/ on NVR appliances and flag names matching sensitive resources such as passwd, shadow, or configuration files

Monitoring Recommendations

Enable network traffic capture on management interfaces of NUUO NVR devices
Forward web server and application logs to a centralized platform for correlation and long-term retention
Track outbound requests initiated by the NVR host that could indicate use of the http:// stream wrapper for attacker-controlled fetches

How to Mitigate CVE-2026-88623

Immediate Actions Required

Remove or restrict network exposure of the NUUO NVR management interface to trusted administrative networks only
Disable or remove the up.php handler if it is not required for operational workflows
Enforce network-level authentication or VPN access in front of affected devices until a vendor fix is available
Audit /tmp/ on affected appliances for staged files indicating prior exploitation

Patch Information

No vendor patch has been referenced in the published advisory data. Consult the NUUO official website for vendor updates and monitor the GitHub Security Gist referenced by NVD for additional technical details.

Workarounds

Block external access to up.php at a reverse proxy or firewall using URL path filters
Configure PHP to disable remote and non-file stream wrappers by setting allow_url_fopen=Off and restricting open_basedir to expected directories
Apply strict egress and ingress access control lists on network segments hosting NUUO NVR devices

bash

# Configuration example: restrict PHP stream wrappers and file access scope
allow_url_fopen = Off
allow_url_include = Off
open_basedir = "/var/www/nuuo:/tmp/nuuo"
disable_functions = fopen,file_get_contents,readfile