CVE-2026-34428
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
Vvveb prior to version 1.0.8.1 contains a server-side request forgery (SSRF) vulnerability in the oEmbedProxy action of the editor/editor module. The url parameter is passed directly to getUrl() via curl without scheme or destination validation. Authenticated backend users can supply file:// URLs to read arbitrary files readable by the web server process or http:// URLs targeting internal network addresses to probe internal services, with response bodies returned directly to the caller.
Risk Assessment
An attacker can read sensitive files from the server (e.g., configuration files, passwords) or scan the internal network, potentially leading to privilege escalation and further compromise of the infrastructure.
Recommendation
Immediately upgrade Vvveb to version 1.0.8.1 or later. If upgrading is not possible, restrict backend access to trusted users and block the use of file:// URLs and internal IP addresses in the url parameter.
Other vulnerabilities in Vvveb
See all- CVE-2026-41938High
Vvveb before version 1.0.8.2 contains an unrestricted file upload vulnerability in the media upload handler that allows authenticated users with media-upload permissions to bypass extension restrictions by uploading a .htaccess file. This enables attackers to upload .phtml files containing arbitrary PHP code and execute the payload through an unauthenticated HTTP GET request.
- CVE-2026-41936High
Vvveb before version 1.0.8.2 contains an XML external entity (XXE) injection vulnerability in the admin Tools/Import feature that allows authenticated site_admin users to read arbitrary files and modify database records.
- CVE-2026-41934High
Vvveb before version 1.0.8.2 contains an authenticated remote code execution vulnerability in the admin code editor that allows low-privilege authenticated users to execute arbitrary code through insufficient file extension restrictions.
- CVE-2026-41930Critical
Vvveb before version 1.0.8.2 contains a hard-coded credentials vulnerability in its docker-compose-apache.yaml configuration that allows unauthenticated attackers to access the bundled phpMyAdmin container with pre-configured database credentials.
- CVE-2026-39918Critical
Vvveb prior to version 1.0.8.1 contains a code injection vulnerability in the installation endpoint where the subdir POST parameter is written unsanitized into the env.php configuration file. Attackers can inject arbitrary PHP code by breaking out of the string context in the define statement, leading to unauthenticated remote code execution as the web server user.
- CVE-2026-49228High
Vvveb before version 1.0.8.4 allows a low-privileged Vendor to access products owned by another Vendor. The product controller does not verify ownership for duplicate and delete actions, enabling reading, duplicating, and deleting products and related data.
- CVE-2026-49225High
Vvveb before version 1.0.8.4 allows a low-privileged Vendor to access revisions for products owned by another Vendor. SQL queries do not verify product ownership for revision reads, restores, and deletes.
- CVE-2026-49224High
Vvveb before version 1.0.8.4 allows a low-privileged Author to access revisions for posts owned by another Author. SQL queries do not verify post ownership for revision lists, reads, restores, and deletes.
- CVE-2026-49223High
Vvveb before version 1.0.8.4 allows a low-privileged Vendor to manage reviews under another Vendor's products. SQL queries do not verify product ownership for reviews.
- CVE-2026-49222High
Vvveb before version 1.0.8.4 allows a low-privileged Vendor to manage questions under another Vendor's products. SQL queries do not verify product ownership for questions.
Original NVD description (English source)
Vvveb prior to 1.0.8.1 contains a server-side request forgery vulnerability in the oEmbedProxy action of the editor/editor module where the url parameter is passed directly to getUrl() via curl without scheme or destination validation. Authenticated backend users can supply file:// URLs to read arbitrary files readable by the web server process or http:// URLs targeting internal network addresses to probe internal services, with response bodies returned directly to the caller.