Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, getThemeFolder() in admin/controller/editor/revisions.php returns the attacke…
Medium CVSS 5.4
Summary
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, getThemeFolder() in admin/controller/editor/revisions.php returns the attacker-controlled theme parameter without sanitization, and backupFolder() concatenates it beneath DIR_THEMES before editor/revisions/load or editor/revisions/delete operates on a named .html file. sanitizeBackupFileName() strips traversal characters only from the separate file parameter and does not pro…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://github.com/givanz/Vvveb/commit/1d76ad52402beeed623a7e386c6796126689a746
- https://github.com/givanz/Vvveb/releases/tag/1.0.8.5
- https://github.com/givanz/Vvveb/security/advisories/GHSA-gjxp-vrcw-69v8
- https://github.com/givanz/Vvveb/security/advisories/GHSA-gjxp-vrcw-69v8
Timeline
- nvd_ingest NVD