CVE-2026-54613Medium· 5.4▾ TwilightPoC availableVvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, getThemeFolder() in admin/controller/editor/revisions.php returns the attacker-controlled theme parameter without s…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 29.7 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
Exploit / PoC code exists
0.2% → 0.3%
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, getThemeFolder() in admin/controller/editor/revisions.php returns the attacker-controlled theme parameter without sanitization, and backupFolder() concatenates it beneath DIR_THEMES before editor/revisions/load or editor/revisions/delete operates on a named .html file. sanitizeBackupFileName() strips traversal characters only from the separate file parameter and does not protect the theme directory component. An authenticated user with the default Editor role and editor/* permission can submit traversal sequences that redirect file_get_contents() or unlink() to a reachable backup subdirectory outside the web root. A valid admin session and CSRF token are required, the read is limited to .html files in backup directories, and deletion additionally requires filesystem write permission. This can disclose sensitive exported site content or remove backup data. This issue is fixed in version 1.0.8.5.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-54612High· 8.8Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores
CVE-2026-55231High· 7.2Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores
CVE-2026-54506High· 7.6Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores
CVE-2026-54507High· 8.4Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores
CVE-2025-12203Medium· 6.3A weakness has been identified in givanz Vvveb up to 1.0.7.3
CVE-2026-55232High· 7.6Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores