CVE-2026-88623 describes an arbitrary file read vulnerability in NUUO Network Video Recorder 2.0.0. The up.php script accepts a url parameter via POST without requiring authentication. The parameter is passed to fopen() in binary read-only mode, and the content is saved to the /tmp/ directory with a filename derived from the basename of the URL. This behavior enables an attacker to read arbitrary files by specifying crafted URLs, potentially exposing sensitive information.

An unauthenticated attacker can exploit this vulnerability to read arbitrary files accessible by the application, potentially leading to disclosure of sensitive information stored on the system. The lack of authentication requirement increases the risk of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the up.php endpoint and monitor for suspicious POST requests containing the url parameter. Consider implementing input validation and authentication controls to prevent unauthorized file reads.