CVE-2026-54612

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54612
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54612.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54612
Aliases
  • GHSA-c3v9-3xrq-pvqv
Published
2026-09-17T21:46:27Z
Modified
2026-09-20T11:30:48Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Vvveb: Authenticated editor path traversal to PHP file write/RCE via data-v-save-global
Details

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. From 1.0.0 until 1.0.8.5, saveGlobalElements() in admin/controller/editor/global-trait.php concatenates the attacker-controlled file portion of data-v-save-global to the active theme directory before loadHTMLFile() and file_put_contents() operate on it. An authenticated user with the default Editor role and editor/* permission can submit crafted HTML to module=editor/editor&action=save and traverse to an existing writable PHP file outside the theme directory. If the target is web-accessible, editor-controlled PHP content executes in the web server context; a shipped public/vadmin/index.php entrypoint can be used as an execution trampoline rather than requiring a test-only file. This can permit persistent webshell placement and compromise application confidentiality, integrity, and availability. This issue is fixed in version 1.0.8.5.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22",
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54612.json"
}
References

Affected packages

Git / github.com/givanz/vvveb

Affected ranges

Type
GIT
Repo
https://github.com/givanz/vvveb
Events
Introduced
45b62b1662906b3e3e806915e5135dcbe17f741e
Fixed
c8fef41ad8651d348050c513451755ab8882b97e
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "1.0.0"
        },
        {
            "fixed": "1.0.8.5"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.7.1
1.0.7.2
1.0.7.3
1.0.8
1.0.8.1
1.0.8.2
1.0.8.3
1.0.8.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54612.json"