CVE-2026-34428: Vvveb < 1.0.8.1 SSRF via oEmbedProxy
Vvveb prior to 1.0.8.1 contains a server-side request forgery vulnerability in the oEmbedProxy action of the editor/editor module where the url parameter is passed directly to getUrl() via curl without scheme or destination validation. Authenticated backend users can supply file:// URLs to read arbitrary files readable by the web server process or http:// URLs targeting internal network addresses to probe internal services, with response bodies returned directly to the caller.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34428?
CVE-2026-34428 has been identified as a high severity vulnerability due to its potential for server-side request forgery.
How do I fix CVE-2026-34428?
To fix CVE-2026-34428, upgrade Vvveb to version 1.0.8.1 or later where the vulnerability has been addressed.
Who is affected by CVE-2026-34428?
CVE-2026-34428 affects all versions of Vvveb prior to 1.0.8.1.
What are the implications of CVE-2026-34428?
The implications of CVE-2026-34428 include the potential for attackers to send unauthorized requests on behalf of the server, which could lead to data exfiltration or exploitation of internal services.
Is authentication required to exploit CVE-2026-34428?
Yes, exploitation of CVE-2026-34428 requires authentication as it affects authenticated backend users.