Vvveb CMS CVE-2026-54612

Requires an authenticated account holding the 'editor/*' permission - which the DEFAULT Editor role granted in versions 1.0.0 through pre-1.0.8.5, so a stock low-privileged Editor suffices. Exploitation targets saveGlobalElements() via module=editor/editor&action=save using the data-v-save-global filename field to path-traverse out of the active theme directory to a writable PHP file. Full RCE additionally requires the traversal target to be web-accessible (the shipped public/vadmin/index.php can serve as the execution trampoline); a target that is writable but not web-served yields file tampering without direct execution. Limiting factors: authentication is required (PR:L, not unauthenticated), and deployments that already removed 'editor/*' from the Editor role or upgraded to 1.0.8.5 (where the filename is sanitized) are not exposed.

This is a genuine high-priority finding. The vendor CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) is consistent with the description: a network-reachable admin action reachable by a low-privileged authenticated user (PR:L) with no user interaction, chaining a path traversal into arbitrary PHP write and execution. The severity is credible because the write primitive lands editor-controlled PHP into a web-accessible location and the description names a shipped trampoline entrypoint (public/vadmin/index.php), so exploitation does not depend on a test-only artifact. Tempering the raw score: it requires an authenticated Editor account, and the fix ALSO removed 'editor/*' from the default Editor role permission set - meaning the pre-patch default did grant the needed permission, but any hardened deployment that already restricted the Editor role would not be exposed. No EPSS score, no CISA KEV entry, and no public POC are present in the provided data, so per precision rules this is 'no public exploit identified at time of analysis' - however, the fix commit is public and the mechanism (sanitizeFileName() on the decoded filename) reveals the exploitable path, lowering the bar to weaponize. Net: real, patchable priority for any Vvveb operator, but not evidence of active mass exploitation.

An attacker holding (or phishing) a default Editor account logs into the Vvveb admin, opens the page builder, and submits crafted HTML to module=editor/editor&action=save whose data-v-save-global filename portion uses ../ sequences to escape the active theme directory and target a writable, web-accessible PHP file such as the public/vadmin/index.php trampoline. saveGlobalElements() decodes and concatenates that path, then loadHTMLFile()/file_put_contents() write attacker PHP into it, yielding a persistent webshell executing in the web server context. No public POC is identified, but the public fix commit reveals the vulnerable filename-handling path.