Vvveb CMS EUVD-2026-91037

Requires an authenticated Vvveb admin-panel account that holds backup access - default role site_admin or higher - per the vendor description; this is the primary limiting factor and matches the CVSS PR:H metric. The flaw resides in the central path sanitizer used by the backup/file functionality, so exploitation depends on access to that feature rather than on any non-default configuration. No user interaction is needed (UI:N). Affected versions are all releases prior to 1.0.8.6; the fix ('Added recursive filtering sanitizeFileName()') landed in 1.0.8.6, so unpatched instances below that version are exposed. Exploitation is further bounded by the obscurity and low deployment footprint of the product.

This is a genuine high-severity flaw but not a mass-exploitation priority. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N, base 7.2) confirms network-reachable, low-complexity exploitation with full C/I/A impact, but the PR:H requirement is the dominant limiting factor: the attacker must already hold an authenticated admin-panel account with backup access (default role site_admin or higher). No EPSS score was provided in the input, so exploitation-probability cannot be quantified. There is no CISA KEV listing and no public exploit code referenced - status is 'no public exploit identified at time of analysis.' There is no SSVC decision data in the input. The signals are internally consistent (high privilege barrier, high technical impact), so this reads as a post-authentication privilege-abuse/path-traversal issue affecting a niche CMS rather than a widespread drive-by threat; prioritize patching where Vvveb is internet-exposed and admin accounts may be shared or weakly protected.

An authenticated site_admin (or higher) in the Vvveb admin panel abuses the backup/file feature, whose flawed central path sanitizer fails to constrain traversal, to read config/db.php and recover the database credentials, then reads host files such as /etc/passwd. The attacker then deletes config/db.php to force the site back into install mode, enabling a full takeover. No public exploit code is referenced in the input, and exploitation requires a valid high-privilege account.