CVE-2026-34733 — Improper Access Control in Avideo

CWE-284 — Improper Access Control4 documents4 sources
Severity
7.3HIGHNVD
EPSS
0.1%
top 79.25%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Wwbn Avideo
Timeline
PublishedMar 31
Latest updateApr 1

Description

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo installation script install/deleteSystemdPrivate.php contains a PHP operator precedence bug in its CLI-only access guard. The script is intended to run exclusively from the command line, but the guard condition !php_sapi_name() === 'cli' never evaluates to true due to how PHP resolves operator precedence. The ! (logical NOT) operator binds more tightly than === (strict comparison), causing the expression to alwa…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LExploitability: 3.9 | Impact: 3.4

Affected Packages2 packages

▶NVDwwbn/avideo26.0
▶Packagistwwbn/avideo26.0

🔴Vulnerability Details

2
OSV
AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard↗2026-04-01
▶
GHSA
AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard↗2026-04-01
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-34733 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶