CVE-2026-39918

Vvveb before version 1.0.8.2 contains an unrestricted file upload vulnerability in the media upload handler that allows authenticated users with media-upload permissions to bypass extension restrictions by uploading a .htaccess file. This enables attackers to upload .phtml files containing arbitrary PHP code and execute the payload through an unauthenticated HTTP GET request.

Vvveb before version 1.0.8.2 contains an XML external entity (XXE) injection vulnerability in the admin Tools/Import feature that allows authenticated site_admin users to read arbitrary files and modify database records.

Vvveb before version 1.0.8.2 contains an authenticated remote code execution vulnerability in the admin code editor that allows low-privilege authenticated users to execute arbitrary code through insufficient file extension restrictions.

Vvveb before version 1.0.8.2 contains a hard-coded credentials vulnerability in its docker-compose-apache.yaml configuration that allows unauthenticated attackers to access the bundled phpMyAdmin container with pre-configured database credentials.

Vvveb prior to version 1.0.8.6 contains an SSRF vulnerability because host validation only handles IPv4, not IPv6. An authenticated admin-panel user can exploit the oEmbed proxy to read internal services and cloud metadata, including IAM credentials.

Vvveb prior to version 1.0.8.6 has a flawed path sanitizer that allows an authenticated user with backup access to read and delete arbitrary files on the server. This can expose database credentials, read system files, and delete config/db.php to enable full site takeover.

Vvveb prior to version 1.0.8.6 has an HTML sanitizer that fails to strip event-handler attributes when a tag contains a greater-than character inside a quoted attribute value. A low-privilege content author can store malicious JavaScript that executes in browsers of visitors and administrators, potentially leading to admin account takeover.

In Vvveb prior to 1.0.8.5, getThemeFolder() returns the attacker-controlled theme parameter without sanitization, and backupFolder() concatenates it beneath DIR_THEMES before editor/revisions/load or editor/revisions/delete operates on a named .html file. sanitizeBackupFileName() strips traversal characters only from the separate file parameter and does not protect the theme directory component. An authenticated user with the default Editor role and editor/* permission can submit traversal sequences that redirect file_get_contents() or unlink() to a reachable backup subdirectory outside the web root.

In Vvveb CMS from 1.0.0 to 1.0.8.5, saveGlobalElements() concatenates the attacker-controlled file portion of data-v-save-global to the active theme directory, enabling path traversal. An authenticated user with the default Editor role can write arbitrary PHP content outside the theme directory, allowing persistent webshell placement.

In Vvveb prior to 1.0.8.5, the oEmbedProxy() handler accepts an attacker-controlled url parameter and passes it to getUrl(), while validateUrl() only checks the hostname string, not its resolved addresses. An authenticated admin-panel user can trigger requests to private, loopback, link-local, or reserved addresses.