CVE-2026-34733
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
A vulnerability was found in AVideo version 26.0 and earlier in the install/deleteSystemdPrivate.php script. Due to a PHP operator precedence bug, the condition !php_sapi_name() === 'cli' always evaluates to false, allowing remote unauthenticated access to the script, which deletes files from the temp directory and discloses its contents.
Risk Assessment
An attacker can remotely delete files from the server's temp directory and read their listing, potentially disrupting the application or leaking information.
Recommendation
Apply a patch immediately or remove the install/deleteSystemdPrivate.php file if not essential.
Original NVD description (English source)
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo installation script install/deleteSystemdPrivate.php contains a PHP operator precedence bug in its CLI-only access guard. The script is intended to run exclusively from the command line, but the guard condition !php_sapi_name() === 'cli' never evaluates to true due to how PHP resolves operator precedence. The ! (logical NOT) operator binds more tightly than === (strict comparison), causing the expression to always evaluate to false, which means the die() statement never executes. As a result, the script is accessible via HTTP without authentication and will delete files from the server's temp directory while also disclosing the temp directory contents in its response. At time of publication, there are no publicly available patches.