CVE-2026-112904 Details
Description
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. In versions 1.0.8.6 and prior, the nextRestore() and nextBackup() functions in the backup controller accept a file GET parameter and concatenate it directly to DIR_BACKUP without calling sanitizeFileName(). This allows an authenticated administrator to read arbitrary files on the server (via nextRestore) and write SQL dump content to arbitrary locations (via nextBackup). This is inconsistent with the sibling functions restore(), delete(), and download() which all correctly call sanitizeFileName() first. This issue has been patched via commit aa29cb0.
A path traversal vulnerability has been identified in Vvveb CMS versions through 1.0.8.6. The issue resides in the backup controller's nextRestore() and nextBackup() functions, which improperly handle file parameters by concatenating them directly to the backup directory path without sanitization. This flaw enables authenticated administrators to read arbitrary server files via nextRestore() and to write SQL dump files to any location on the server via nextBackup(). The vulnerability arises because these functions fail to sanitize file names before use, unlike their counterparts restore(), delete(), and download(), which properly sanitize input. The vulnerability has been patched in Vvveb version 1.0.8.7.
Users can update to Vvveb CMS version 1.0.8.7 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 23, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/givanz/Vvveb/security/advisories/GHSA-75qx-795q-v79g | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/givanz/Vvveb/commit/aa29cb013e5037d75f6780741bac6b69b9d403a2 | [email protected] | Source CodeVendor |
| https://github.com/givanz/Vvveb/security/advisories/GHSA-75qx-795q-v79g | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-26 | Path Traversal: '/dir/../filename' | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| givanz Vvveb | <= 1.0.8.6 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 23, 2026 | New CVE Received | [email protected] |