File Manipulation Vulnerability in Vvveb CMS by Givanz
CVE-2026-112904

8.7HIGH

Key Information:

Vendor

Givanz

Status
Vvveb
Vendor
CVE Published:
23 October 2026

What is CVE-2026-112904?

In Vvveb CMS versions up to 1.0.8.6, a vulnerability exists in the backup controller's nextRestore() and nextBackup() functions. These functions improperly handle a file GET parameter, concatenating it directly to DIR_BACKUP without proper sanitization using sanitizeFileName(). As a result, an authenticated administrator can exploit this flaw to read sensitive files on the server or write SQL dump content to unauthorized locations. This vulnerability contrasts with other related functions that correctly sanitize input, highlighting a critical inconsistency in the application's file handling process. A patch has been implemented to address this issue.

Affected Version(s)

Vvveb < aa29cb013e5037d75f6780741bac6b69b9d403a2

References

https://github.com/givanz/Vvveb/security/advisories/GHSA-...
x_refsource_CONFIRM
https://github.com/givanz/Vvveb/commit/aa29cb013e5037d75f...
x_refsource_MISC

CVSS V3.1

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.