Executive brief
WWBN AVideo, an open-source video hosting platform, contains a security flaw in a maintenance script that allows unauthorized users to delete temporary files from the server. By accessing a specific web address, an attacker can trigger the deletion of files older than 24 hours, such as user session data or pending video uploads, potentially disrupting service. Additionally, the script reveals the names and locations of files stored in the server's temporary directory, which could assist in further attacks.
Technical details
A vulnerability exists in the `install/deleteSystemdPrivate.php` script due to an incorrect implementation of a CLI-only access guard. The check `!php_sapi_name() === 'cli'` fails because the logical NOT (!) operator has higher precedence than the strict comparison (===) operator, causing the expression to always evaluate to false and bypass the `die()` statement when accessed via HTTP. An unauthenticated attacker can reach this script over the network to trigger the deletion of files in the system's temporary directory (older than 24 hours) and view the directory's contents in the HTTP response. This can lead to a denial of service by purging session files or temporary uploads. As of the advisory date, no official patch is available; the recommended fix is to use the `!==` operator for the SAPI check.
Affected products
- WWBN AVideo <= 26.0
Timeline
- 2026-03-30: advisory: GitHub Security Advisory published
- 2026-03-31: disclosed: CVE-2026-34733 published to NVD