CVE-2026-55231: Vvveb: Path traversal in Vvveb via sanitizeFileName() bypass enables arbitrary file read and delete through backup tools
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, a flawed central path sanitizer lets an authenticated admin-panel user who holds backup access (default role siteadmin or higher) read and delete arbitrary files on a server. An attacker can recover database credentials from config/db.php, read host files such as /etc/passwd, and delete config/db.php to push a site back into install mode for a full takeover. This issue has been patched in version 1.0.8.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vvvebto a version that resolves this vulnerability.Fixed in 1.0.8.6
Event History
Frequently Asked Questions
Which users can exploit this issue?
An authenticated user with access to the admin panel and backup functionality can exploit it. The default affected role is site_admin or any higher-privileged role with backup access.
Are default installations affected?
Yes, default installations may be affected if a site_admin user can access the backup tools. The vulnerability exists in versions prior to 1.0.8.6.
What could an attacker do after exploiting the backup tools?
They can read or delete arbitrary server files. Examples include reading database credentials from config/db.php, reading /etc/passwd, or deleting config/db.php to return the site to install mode and enable a full takeover.
How can I remediate this vulnerability?
Upgrade Vvveb to version 1.0.8.6, which includes the patch. Until upgrading, restrict admin-panel and backup-tool access to only trusted users with a business need.