CVE-2026-34733 - Vulnerability Analysis

Overview

WWBN AVideo <= 26.0 contains a broken access control caused by a PHP operator precedence bug in install/deleteSystemdPrivate.php CLI-only guard, letting remote attackers delete temp files and disclose directory contents via HTTP, exploit requires no special privileges.

Severity & Score

Impact

Remote attackers can delete server temp files and disclose directory contents, potentially disrupting service and exposing sensitive information.

Mitigation

Update to the latest version once a patch is available or apply custom access control fixes.

References

• https://github.com/WWBN/AVideo/security/advisories/GHSA-wwpw-hrx8-79r5

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner