PT-2026-29363 · Avideo · Avideo

Adrgs · Published 2026-03-31 · Updated 2026-04-01 · CVE-2026-34733

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions AVideo versions 26.0 and prior

Description AVideo is an open source video platform. The installation script, install/deleteSystemdPrivate.php, contains a PHP operator precedence bug in its command-line interface (CLI)-only access guard. The guard condition !php sapi name() === 'cli' incorrectly evaluates to false due to PHP’s operator precedence rules. Specifically, the ! (logical NOT) operator binds more tightly than === (strict comparison). This allows the script to be accessed via HTTP without authentication, leading to the deletion of files from the server’s temp directory and the disclosure of the temp directory contents in the response. The php sapi name() function returns the type of interface between PHP and the web server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-34733

GHSA-WWPW-HRX8-79R5

Affected Products

Avideo

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34733.json · Exploit
• https://github.com/WWBN/AVideo/security/advisories/GHSA-wwpw-hrx8-79r5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34733 · Security Note
• https://osv.dev/vulnerability/GHSA-wwpw-hrx8-79r5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-34733 · Vendor Advisory
• https://github.com/WWBN/AVideo · Note
• https://github.com/WWBN/AVideo/commit/355e8c70806694b3bf8605d75e1bd1c695cd95e7 · Note
• https://twitter.com/cyberbivash/status/2039091964931383346 · Twitter Post
• https://twitter.com/CVEnew/status/2039372119222403472 · Twitter Post