The vulnerability in WWBN AVideo (<= 26.0) arises from a PHP operator precedence error in the install/deleteSystemdPrivate.php script's access guard. The condition !php_sapi_name() === 'cli' is intended to restrict script execution to the command line interface. However, because the logical NOT operator (!) binds more tightly than the strict equality operator (===), the expression always evaluates to false, preventing the intended die() call. Consequently, the script is accessible over HTTP without authentication, enabling attackers to delete files in the server's temporary directory and disclose its contents. There are no publicly available patches or fixes at this time.

An attacker can remotely invoke the install/deleteSystemdPrivate.php script via HTTP without authentication, leading to unauthorized deletion of files in the server's temporary directory and disclosure of its contents. This can result in partial denial of service due to file deletion and potential information leakage about the server environment. The CVSS score of 6.5 reflects a medium severity impact with low complexity and no required privileges or user interaction.

At the time of this report, no official patches or fixes are publicly available for this vulnerability. Users should monitor the vendor's advisory channels for updates and apply any future patches promptly. As a temporary mitigation, restricting HTTP access to the install/deleteSystemdPrivate.php script (e.g., via web server configuration or firewall rules) to prevent unauthorized access is recommended.