CVE-2026-5615: givanz Vvvebjs File Upload Endpoint upload.php cross site scripting
A weakness has been identified in givanz Vvvebjs up to 2.0.5. The affected element is an unknown function of the file upload.php of the component File Upload Endpoint. This manipulation of the argument uploadAllowExtensions causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. Patch name: 8cac22cff99b8bc701c408aa8e887fa702755336. Applying a patch is the recommended action to fix this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
givanz Vvvebjs File Upload Endpointto a version that resolves this vulnerability.Fixed in 2.0.5Patch 8cac22cff99b8bc701c408aa8e887fa702755336 - Configuration
Validate/ignore the uploadAllowExtensions argument in upload.php so it cannot be manipulated to perform cross site scripting.
File Upload Endpoint (upload.php) uploadAllowExtensions = disable/avoid setting-manipulation that leads to cross site scripting - Compensating control
Given remote exploitation is possible, restrict external access to the File Upload Endpoint (upload.php) until the patch is applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5615?
CVE-2026-5615 is classified as a medium severity vulnerability due to the potential for cross-site scripting attacks.
How do I fix CVE-2026-5615?
To fix CVE-2026-5615, upgrade the givanz Vvvebjs application to version 2.0.6 or later.
What vulnerabilities does CVE-2026-5615 address?
CVE-2026-5615 addresses a cross-site scripting vulnerability related to the file upload functionality in givanz Vvvebjs.
Which versions of givanz Vvvebjs are affected by CVE-2026-5615?
Version 2.0.5 and earlier of givanz Vvvebjs are affected by CVE-2026-5615.
Is user data at risk due to CVE-2026-5615?
Yes, user data may be at risk because CVE-2026-5615 can allow attackers to execute malicious scripts in the user's browser.