CVE-2026-112904

In Vvveb prior to version 1.0.8.7, an authenticated IDOR on the admin/auth-token endpoint allows any administrator to read and overwrite another administrator's API tokens. The issue has been patched in version 1.0.8.7.

In Vvveb prior to version 1.0.8.7, the password reset functionality is vulnerable to an authentication bypass due to insufficient validation of the user and token GET parameters. The issue has been patched in version 1.0.8.7.

Vvveb before version 1.0.8.2 contains a hard-coded credentials vulnerability in its docker-compose-apache.yaml configuration that allows unauthenticated attackers to access the bundled phpMyAdmin container with pre-configured database credentials.

Vvveb prior to version 1.0.8.1 contains a code injection vulnerability in the installation endpoint where the subdir POST parameter is written unsanitized into the env.php configuration file. Attackers can inject arbitrary PHP code by breaking out of the string context in the define statement, leading to unauthenticated remote code execution as the web server user.

Vvveb prior to version 1.0.8.6 contains an SSRF vulnerability because host validation only handles IPv4, not IPv6. An authenticated admin-panel user can exploit the oEmbed proxy to read internal services and cloud metadata, including IAM credentials.

Vvveb prior to version 1.0.8.6 has a flawed path sanitizer that allows an authenticated user with backup access to read and delete arbitrary files on the server. This can expose database credentials, read system files, and delete config/db.php to enable full site takeover.

Vvveb prior to version 1.0.8.6 has an HTML sanitizer that fails to strip event-handler attributes when a tag contains a greater-than character inside a quoted attribute value. A low-privilege content author can store malicious JavaScript that executes in browsers of visitors and administrators, potentially leading to admin account takeover.

In Vvveb prior to 1.0.8.5, getThemeFolder() returns the attacker-controlled theme parameter without sanitization, and backupFolder() concatenates it beneath DIR_THEMES before editor/revisions/load or editor/revisions/delete operates on a named .html file. sanitizeBackupFileName() strips traversal characters only from the separate file parameter and does not protect the theme directory component. An authenticated user with the default Editor role and editor/* permission can submit traversal sequences that redirect file_get_contents() or unlink() to a reachable backup subdirectory outside the web root.

In Vvveb CMS from 1.0.0 to 1.0.8.5, saveGlobalElements() concatenates the attacker-controlled file portion of data-v-save-global to the active theme directory, enabling path traversal. An authenticated user with the default Editor role can write arbitrary PHP content outside the theme directory, allowing persistent webshell placement.

In Vvveb prior to 1.0.8.5, the oEmbedProxy() handler accepts an attacker-controlled url parameter and passes it to getUrl(), while validateUrl() only checks the hostname string, not its resolved addresses. An authenticated admin-panel user can trigger requests to private, loopback, link-local, or reserved addresses.