CVE-2026-126375: Vvveb through 1.0.8.6 Cross-Tenant Digital Asset Tampering via Media Trait
Vvveb through 1.0.8.6 contains a missing authorization vulnerability that allows low-privilege vendors to rename, delete, or overwrite other vendors' digital-asset files in the shared storage/digitalassets directory. Attackers can send rename, delete, or upload requests to product/digital-asset with another vendor's filename to break downloads or substitute malicious content.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A low-privilege vendor account can exploit it. The attacker needs to be able to send rename, delete, or upload requests to the product/digital-asset functionality and supply another vendor's filename.
Are installations using shared digital-asset storage affected?
The issue affects Vvveb through 1.0.8.6 where vendors' assets are stored in the shared storage/digital_assets directory. In that arrangement, one vendor can target files belonging to another vendor.
What is the practical impact of successful exploitation?
An attacker can rename, delete, or overwrite another vendor's digital-asset files. This can break asset downloads or replace legitimate content with malicious content.