EUVD-2026-23852Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
7DescriptionCVE.org
Vvveb prior to 1.0.8.1 contains a server-side request forgery vulnerability in the oEmbedProxy action of the editor/editor module where the url parameter is passed directly to getUrl() via curl without scheme or destination validation. Authenticated backend users can supply file:// URLs to read arbitrary files readable by the web server process or http:// URLs targeting internal network addresses to probe internal services, with response bodies returned directly to the caller.
AnalysisAI
Server-Side Request Forgery in Vvveb CMS versions prior to 1.0.8.1 allows authenticated backend users to read arbitrary local files via file:// URLs or probe internal network services via http:// URLs through the oEmbedProxy action's unvalidated url parameter. The vulnerability (CWE-918) enables information disclosure from the web server's filesystem and internal network reconnaissance. Patch available in version 1.0.8.1. EPSS data not provided; no CISA KEV listing indicates no confirmed widespread exploitation at time of analysis.
Technical ContextAI
Vvveb is an open-source CMS and website builder written in PHP (CPE: cpe:2.3:a:givanz:vvveb). The vulnerability resides in the editor/editor module's oEmbedProxy action, which is designed to fetch oEmbed content from external URLs. The implementation passes user-supplied URL parameters directly to a getUrl() function using cURL without validating the URL scheme (file://, http://, etc.) or destination address. This is a classic CWE-918 Server-Side Request Forgery where the application acts as a proxy for attacker-controlled requests. The lack of scheme validation enables protocol smuggling attacks - the file:// scheme allows local file system access, while http:// permits internal network probing. The response bodies are returned directly to the caller, making this a 'blind' SSRF with full response visibility, significantly increasing its exploitability compared to blind SSRF variants.
RemediationAI
Upgrade immediately to Vvveb 1.0.8.1 or later, which addresses the SSRF vulnerability through URL scheme validation (patch commit: https://github.com/givanz/Vvveb/commit/2d356844f37819bf771e7cd5e12a8686975e0b2b). If immediate patching is not feasible, implement these compensating controls with noted limitations: (1) Restrict backend user access to trusted administrators only - reduces attack surface but does not eliminate insider threat or account compromise scenarios. (2) Deploy web application firewall (WAF) rules to block requests containing file:// schemes or RFC1918 private IP addresses in the url parameter - can be bypassed via URL encoding, DNS rebinding, or redirect chains. (3) Network segmentation: isolate the Vvveb web server from sensitive internal networks and metadata services using firewall rules - prevents internal network probing but does not protect local file access. (4) Run web server process with minimal filesystem permissions - limits file:// URL impact but may break legitimate CMS functionality. All workarounds carry operational trade-offs; vendor patch is the only complete fix. Verify remediation by testing that file:// and internal http:// URLs in oEmbedProxy are rejected post-upgrade.
An issue in vvveb CMS v.1.0.6 allows a remote attacker to execute arbitrary code via the Plugin mechanism. Rated critica
A vulnerability was found in givanz Vvveb 1.0.5. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploi
Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute
Reflected Cross-Site Scripting (XSS) vulnerability in VvvebJs before version 1.7.7, allows remote attackers to execute a
A security flaw has been discovered in givanz Vvveb up to 1.0.7.2. Rated medium severity (CVSS 5.5), this vulnerability
A security vulnerability has been detected in givanz Vvveb 1.0.7.2. Rated medium severity (CVSS 5.3), this vulnerability
Remote code execution in Vvveb CMS v1.0.8 allows authenticated administrators to execute arbitrary system commands as ww
Remote code execution in Vvveb CMS versions prior to 1.0.8.1 allows unauthenticated attackers to inject arbitrary PHP co
Hard-coded credentials in Vvveb's Docker deployment expose the entire application database to unauthenticated remote att
Stored cross-site scripting in Vvveb prior to 1.0.8.1 allows authenticated users with media upload and rename permission
Insecure Direct Object Reference in Vvveb CMS prior to 1.0.8.4 allows any authenticated low-privileged Vendor to read, d
Broken object-level authorization in Vvveb CMS prior to 1.0.8.4 allows an authenticated low-privilege Vendor to access,
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today