CVE-2026-34733: 
PHP vulnerability analysis and mitigation

CVE-2026-34733 is an unauthenticated file deletion and information disclosure vulnerability in WWBN AVideo, an open source video platform. It affects all versions up to and including 26.0, stemming from a PHP operator precedence bug in the installation script install/deleteSystemdPrivate.php. The vulnerability was published on March 30–31, 2026, and discovered by aisafe.io. It carries a CVSS v3.1 base score of 6.5 (Medium) per the GitHub Advisory, though Feedly's aggregated data also references a score of 7.3 (High) from NVD (GitHub Advisory, AVideo Advisory).

The root cause is a PHP operator precedence bug (CWE-284: Improper Access Control) in the CLI-only guard at lines 2–4 of install/deleteSystemdPrivate.php. The condition !php_sapi_name() === 'cli' is parsed by PHP as (!php_sapi_name()) === 'cli' — the logical NOT (!) binds more tightly than strict comparison (===). When accessed via HTTP, php_sapi_name() returns a truthy string (e.g., "apache2handler"), so !php_sapi_name() yields false, and false === 'cli' is always false, meaning the die() statement never executes. The script then enumerates the system temp directory via glob(sys_get_temp_dir() . "/*") and deletes any files older than 24 hours using unlink(), while outputting file paths and counts to the HTTP response. The correct fix is to replace the guard with if (php_sapi_name() !== 'cli') (AVideo Advisory, GitHub Advisory).

An unauthenticated remote attacker can exploit this vulnerability to delete files older than 24 hours from the server's system temp directory and disclose its contents. Deleted files may include PHP session files, upload temporaries, cache files, and temp files from other applications sharing the same directory, potentially disrupting session management, file uploads, and other server operations. The script's output also leaks the full temp directory path, file names, and item counts, exposing internal server structure. Repeated requests can be used as a denial-of-service vector to continuously purge temp files (AVideo Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, consisting of a simple unauthenticated HTTP GET request (curl -v "https://your-avideo-instance.com/install/deleteSystemdPrivate.php") that triggers the vulnerability with no prerequisites. The vulnerability requires no authentication, no privileges, and no user interaction, making it trivially exploitable by any network-accessible attacker. The EPSS score is approximately 0.022% (7th percentile), and there is no evidence of in-the-wild exploitation or CISA KEV catalog listing at this time (AVideo Advisory, GitHub Advisory).

1. Reconnaissance: Identify internet-facing WWBN AVideo instances (version ≤ 26.0) using search engines like Shodan or Censys, or by browsing to known AVideo installation paths.
2. Verify endpoint accessibility: Send an unauthenticated HTTP GET request to the vulnerable script:

   curl -v "https://your-avideo-instance.com/install/deleteSystemdPrivate.php"

3. Confirm exploitation: A vulnerable instance returns HTTP 200 with output such as "Found total of 91 items" and lists temp file paths. A patched or correctly configured instance would return "Command Line only".
4. Trigger file deletion: Each HTTP request causes the script to delete all files in the server's temp directory older than 24 hours (e.g., /tmp/old_session_file), and discloses the temp directory path and file names in the response.
5. Repeat for DoS: Send repeated requests to continuously purge temp files, disrupting PHP session management, file uploads, and other temp-dependent operations on the server (AVideo Advisory).

• Network: Unauthenticated HTTP GET requests to /install/deleteSystemdPrivate.php on AVideo instances; HTTP 200 responses from this endpoint (expected to return "Command Line only" if properly guarded).
• Logs: Web server access logs showing GET requests to /install/deleteSystemdPrivate.php from external IP addresses; response bodies containing "Found total of N items" or file path listings.
• File System: Unexpected deletion of files in the system temp directory (e.g., /tmp/), particularly PHP session files (sess_*), upload temporaries (php*), or cache files; sudden reduction in temp directory file count.
• Application Behavior: Unexpected session invalidations or failed file uploads that may indicate temp file deletion; other applications sharing the temp directory experiencing disruptions (AVideo Advisory).

No official vendor patch is available for AVideo as of the time of publication. Recommended mitigations include: (1) restricting HTTP access to the install/ directory using web server configuration (e.g., .htaccess rules for Apache or location blocks for nginx); (2) deleting or renaming install/deleteSystemdPrivate.php if it is no longer needed post-installation; (3) applying network-level access controls to limit exposure of the installation directory to trusted networks only. Developers can fix the code by replacing if (!php_sapi_name() === 'cli') with if (php_sapi_name() !== 'cli') at line 2 of the script (AVideo Advisory, GitHub Advisory).

The vulnerability was discovered and reported by aisafe.io and credited to reporter adrgs and finder aisafe-bot in the GitHub Advisory. The advisory was published by DanielnetoDotCom (an AVideo maintainer) on March 30, 2026. No significant broader media coverage or notable researcher commentary beyond the advisory itself has been identified at this time (AVideo Advisory).