CVE-2026-55232: Vvveb: Server-side request forgery in Vvveb via IPv6 bypass of validateUrl() in editor oEmbed proxy
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb's SSRF guard resolves a host with an IPv4-only function and never inspects IPv6, so any host that lacks an A record passes a private-range check. Editor oEmbed proxy fetches an attacker-supplied URL server side and reflects a response body, so an authenticated admin-panel user (default role siteadmin or higher) can read internal-only services and cloud metadata, including IAM credentials, using an IPv6 literal or a domain that carries only an AAAA record. This issue has been patched in version 1.0.8.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vvvebto a version that resolves this vulnerability.Fixed in 1.0.8.6
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with access to the Vvveb admin panel and the default site_admin role or higher can exploit it. The attacker can supply a URL to the editor oEmbed proxy.
Which deployments are affected?
Vvveb versions prior to 1.0.8.6 are affected. The bypass applies when the supplied host is an IPv6 literal or a domain with only an AAAA record and no A record.
What could an attacker access through the proxy?
The proxy can make server-side requests to internal-only services and cloud metadata endpoints, then reflect the response body to the attacker. This can expose sensitive data, including cloud IAM credentials.
What should be done if the instance cannot be upgraded immediately?
The provided data identifies the oEmbed proxy as the affected request path and limits exploitation to authenticated admin-panel users with site_admin or higher privileges. Restrict access to those accounts and review their use of the editor oEmbed proxy until version 1.0.8.6 can be deployed.