givanz Vvveb CVE-2025-12203
LOWSeverity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
A weakness has been identified in givanz Vvveb up to 1.0.7.3. This issue affects the function sanitizeFileName of the file system/functions.php of the component Code Editor. Executing a manipulation of the argument File can lead to path traversal. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This patch is called b0fa7ff74a3539c6d37000db152caad572e4c39b. Applying a patch is advised to resolve this issue.
AnalysisAI
Path traversal in givanz Vvveb up to 1.0.7.3 allows authenticated remote attackers to manipulate the File argument in the Code Editor's sanitizeFileName function, enabling unauthorized file system access with low confidentiality, integrity, and availability impact. Publicly available exploit code exists, though EPSS score of 0.05% suggests limited real-world exploitation despite the availability of proof-of-concept.
Technical ContextAI
This vulnerability exists in the sanitizeFileName function within system/functions.php of the Code Editor component. Path traversal (CWE-22) occurs when user-supplied input is not properly validated before being used in file system operations, allowing attackers to navigate directory hierarchies using sequences like '../' to access files outside the intended directory. The affected PHP-based Vvveb page builder fails to adequately sanitize the File parameter, permitting directory traversal attacks that bypass intended access restrictions.
RemediationAI
Apply the vendor-released patch commit b0fa7ff74a3539c6d37000db152caad572e4c39b available at https://github.com/givanz/Vvveb/commit/b0fa7ff74a3539c6d37000db152caad572e4c39b to upgrade Vvveb beyond version 1.0.7.3. This patch corrects the sanitizeFileName function to properly validate and sanitize the File argument, preventing path traversal attacks. As an interim compensating control, restrict network access to the Vvveb application to trusted internal networks only, and audit user accounts with Code Editor access to ensure only authorized administrators retain permissions. If immediate patching is infeasible, disable the Code Editor component entirely until the update can be deployed, though this may impact legitimate page-building functionality.
More from same product – last 7 days
Authentication bypass in Discuz! X5.0 releases 20260320 through 20260501 allows unauthenticated remote attackers to acce
Authenticated remote code execution in Discuz! X5.0 releases 20260320 through 20260501 allows administrators to chain a
Unauthenticated PHP Object Injection in the Happyforms WordPress plugin (versions <= 1.26.13) allows remote attackers to
Unauthenticated PHP Object Injection in the Broadcast Live Video WordPress plugin (versions prior to 7.1.3) allows remot
Unauthenticated PHP object injection in the WordPress plugin 'Integration for Keap/Infusionsoft and Contact Form 7, WPFo
Share
External POC / Exploit Code
Leaving vuln.today