A PHP operator precedence bug in the command‑line guard of the install/deleteSystemdPrivate.php script allows the script to run from a web request. The guard condition never triggers the die() exit, so when the script is accessed over HTTP the temporary directory contents are listed and files are deleted. This flaw enables an unauthenticated attacker to remove files from the server’s temp directory and expose potentially sensitive data, compromising data integrity and confidentiality.

The weakness affects the WWBN AVideo platform in all releases 26.0 and earlier. The vulnerable code resides in install/deleteSystemdPrivate.php, which should only be executed from the command line but is accessible via the web server. No other vendors, products, or later versions are reported as affected.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is below 1 %, and the issue is not listed in the CISA KEV catalog. The exploitation path is straightforward: a remote attacker can issue an HTTP request to the vulnerable script’s URL without authentication, causing file deletion and directory disclosure. No special privileges are required beyond web access, making it a realistic threat for any publicly exposed AVideo installation.