EUVD-2026-17652
GHSA-wwpw-hrx8-79r5
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Despite the moderate CVSS score of 6.5, this vulnerability presents substantial real-world risk due to multiple converging signals. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) indicates network-accessible, low-complexity exploitation requiring no privileges or user interaction, making it trivially exploitable by any remote attacker. The vulnerability is unauthenticated (PR:N), eliminating any authentication barrier. The defect is a logic bug that causes an access control mechanism to fail silently and completely-not a partial bypass or race condition, but an absolute failure of the guard condition. While confidentiality impact is rated low (temp directory contents disclosure) and integrity impact is none (files are deleted but not modified), availability impact is rated low (temp directory deletion); however, depending on application configuration, temp directory exhaustion or loss of temporary cached data could cascade to higher availability impact. No active exploitation or public POC has been confirmed, and no patches have been released, placing this in the critical remediation category for affected installations. Organizations running AVideo 26.0 or earlier should prioritize assessment and mitigation, as the exploit is straightforward and requires no special tools. |
| Exploit ScenarioDerived | An unauthenticated remote attacker sends an HTTP GET or POST request to the AVideo installation at /install/deleteSystemdPrivate.php. Due to the operator precedence bug, the CLI access guard fails silently, and the script executes in the HTTP context. The attacker can then trigger file deletion in the server's temp directory and receive a response containing the temp directory listing, disclosing the file paths and structure. If the temp directory is used by the application to store sensitive cached data, session files, or temporary uploads, an attacker could delete these files to disrupt service, clear audit trails, or trigger application errors. No special exploit code or user interaction is required; the vulnerability is exploitable with a standard HTTP client. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 31, 2026
Unauthenticated remote attackers can bypass CLI-only access controls in WWBN AVideo versions 26.0 and prior via a PHP operator precedence bug in install/deleteSystemdPrivate.php, allowing HTTP access to delete server temp directory files and disclose their contents without authentication. The vulnerability stems from a logic error where !php_sapi_name() === 'cli' evaluates incorrectly due to operator binding precedence, causing the access guard to fail entirely. No public exploit code or active exploitation has been reported at the time of this analysis.
RemediationAI
No vendor-released patch identified at time of analysis. Immediate mitigation steps should include: (1) restricting HTTP access to the install/ directory at the web server level (nginx, Apache) by denying all requests to paths matching install/*.php; (2) if the installation script is no longer needed post-deployment, deleting or moving the entire install/ directory off the web root; (3) implementing a Web Application Firewall (WAF) rule to block HTTP requests to install/deleteSystemdPrivate.php specifically. Administrators should monitor the GitHub Security Advisory (https://github.com/WWBN/AVideo/security/advisories/GHSA-wwpw-hrx8-79r5) for patch availability and upgrade immediately once a patched version is released. Organizations unable to apply patches should apply the web server-level access controls as a temporary measure and validate that no installation scripts remain web-accessible.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the install/deleteSystemdPrivate.php script, which relies on a PHP access guard to restrict execution to CLI contexts only. The guard uses the expression !php_sapi_name() = 'cli', intending to deny access if the script is not running via CLI. However, PHP's operator precedence causes the logical NOT operator (!) to bind more tightly than the strict comparison operator (=), resulting in evaluation as (!php_sapi_name()) = 'cli' instead of the intended !(php_sapi_name() = 'cli'). When accessed via HTTP, php_sapi_name() returns a non-empty string (e.g., 'fpm-fcgi'), and the negation of a non-empty string becomes an empty string, which never equals the string 'cli', causing the guard condition to always evaluate false. This is a CWE-284 (Improper Access Control) vulnerability, specifically an authentication bypass through logic error. The affected product is WWBN AVideo (cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*), with all versions up to and including 26.0 vulnerable.
Know when Avideo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo installation script install/deleteSystemdPrivate.php contains a PHP operator precedence bug in its CLI-only access guard. The script is intended to run exclusively from the command line, but the guard condition !php_sapi_name() = 'cli' never evaluates to true due to how PHP resolves operator precedence. The ! (logical NOT) operator binds more tightly than = (strict comparison), causing the expression to always evaluate to false, which means the die() statement never executes. As a result, the script is accessible via HTTP without authentication and will delete files from the server's temp directory while also disclosing the temp directory contents in its response. At time of publication, there are no publicly available patches.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
A cross-site scripting (xss) vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.
An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath
A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit
An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed
Unauthenticated SQL injection in AVideo before 24.0.
OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbit
A reflected cross-site scripting (xss) vulnerability exists in the charts tab selection functionality of WWBN AVideo 11.
A cross-site scripting (xss) vulnerability exists in the channelBody.php user name functionality of WWBN AVideo 11.6 and
A cross-site scripting (xss) vulnerability exists in the videoAddNew functionality of WWBN AVideo 11.6 and dev master co
An insufficient entropy vulnerability exists in the userRecoverPass.php recoverPass generation functionality of WWBN AVi
WWBN AVideo is an open source video platform. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable
AVideo is an open source video platform. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low
Exploit-DB