CVE-2026-54612

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. From 1.0.0 until 1.0.8.5, saveGlobalElements() in admin/controller/editor/global-trait.php concatenates the attacker-controlled file portion of data-v-save-global to the active theme directory before loadHTMLFile() and file_put_contents() operate on it. An authenticated user with the default Editor role and editor/* permission can submit crafted HTML to module=editor/editor&action=save and traverse to an existing writable PHP file outside the theme directory. If the target is web-accessible, editor-controlled PHP content executes in the web server context; a shipped public/vadmin/index.php entrypoint can be used as an execution trampoline rather than requiring a test-only file. This can permit persistent webshell placement and compromise application confidentiality, integrity, and availability. This issue is fixed in version 1.0.8.5.

• CWE-22
• CWE-94

• https://github.com/givanz/Vvveb/commit/c8fef41ad8651d348050c513451755ab8882b97e
• https://github.com/givanz/Vvveb/releases/tag/1.0.8.5
• https://github.com/givanz/Vvveb/security/advisories/GHSA-c3v9-3xrq-pvqv

Published

Sep 17, 2026

Last Modified

Sep 18, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54605OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols…7.2
• CVE-2026-54606SunEditor is a lightweight and powerful WYSIWYG editor in va…8.5
• CVE-2026-54607FastGPT is a knowledge-based AI application platform. Prior …7.7
• CVE-2026-54608MythicalDash is a Pterodactyl client area. In 3.5.4-aurora a…7.1
• CVE-2026-54609QTI Neon is a minimal, game-agnostic, relay-based UDP multip…8.6
• CVE-2026-54611InstantCMS is a free and open source content management syst…5.5
• CVE-2026-54613Vvveb is a powerful and easy to use CMS with page builder to…5.4
• CVE-2026-54614DebugKit provides a debugging toolbar for CakePHP applicatio…4.3
• CVE-2026-54616NanaZip is the 7-Zip derivative intended for the modern Wind…7.1
• CVE-2026-54617GravitLauncher is an open-source Minecraft launcher based on…9.8
• CVE-2026-54618Obsidian Web MCP is a secure remote MCP server for Obsidian …9.4
• CVE-2026-54619sqlite3 provides Ruby bindings for the SQLite3 embedded data…2