Is there a public PoC exploit available for CVE-2025-12203?

Yes, a public proof-of-concept exploit is available for CVE-2025-12203. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2025-12203?

Yes, a patch is available for CVE-2025-12203. Update the affected software to the latest version immediately.

givanz Vvveb CVE-2025-12203

Q: What is the CVSS score of CVE-2025-12203?

CVE-2025-12203 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

LOW

Path Traversal (CWE-22)

2025-10-27 cna@vuldb.com

PHP Path Traversal Vvveb

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 01:35 vuln.today

DescriptionCVE.org

A weakness has been identified in givanz Vvveb up to 1.0.7.3. This issue affects the function sanitizeFileName of the file system/functions.php of the component Code Editor. Executing a manipulation of the argument File can lead to path traversal. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This patch is called b0fa7ff74a3539c6d37000db152caad572e4c39b. Applying a patch is advised to resolve this issue.

AnalysisAI

Path traversal in givanz Vvveb up to 1.0.7.3 allows authenticated remote attackers to manipulate the File argument in the Code Editor's sanitizeFileName function, enabling unauthorized file system access with low confidentiality, integrity, and availability impact. Publicly available exploit code exists, though EPSS score of 0.05% suggests limited real-world exploitation despite the availability of proof-of-concept.

Technical ContextAI

This vulnerability exists in the sanitizeFileName function within system/functions.php of the Code Editor component. Path traversal (CWE-22) occurs when user-supplied input is not properly validated before being used in file system operations, allowing attackers to navigate directory hierarchies using sequences like '../' to access files outside the intended directory. The affected PHP-based Vvveb page builder fails to adequately sanitize the File parameter, permitting directory traversal attacks that bypass intended access restrictions.

RemediationAI

Apply the vendor-released patch commit b0fa7ff74a3539c6d37000db152caad572e4c39b available at https://github.com/givanz/Vvveb/commit/b0fa7ff74a3539c6d37000db152caad572e4c39b to upgrade Vvveb beyond version 1.0.7.3. This patch corrects the sanitizeFileName function to properly validate and sanitize the File argument, preventing path traversal attacks. As an interim compensating control, restrict network access to the Vvveb application to trusted internal networks only, and audit user accounts with Code Editor access to ensure only authorized administrators retain permissions. If immediate patching is infeasible, disable the Code Editor component entirely until the update can be deployed, though this may impact legitimate page-building functionality.