Executive brief
Vvveb, an open-source content management system and website builder, contains a security flaw in its editor module. An authorized user with backend access can exploit this to view sensitive files on the server or scan the company's internal network. This could lead to the exposure of private configuration data or unauthorized access to other internal systems.
Technical details
A server-side request forgery (SSRF) vulnerability exists in Vvveb versions prior to 1.0.8.1 within the oEmbedProxy action of the editor/editor module. The root cause is the 'url' parameter being passed directly to the getUrl() function via cURL without proper scheme or destination validation. An authenticated backend user can provide 'file://' URLs to read arbitrary local files or 'http://' URLs to probe internal network services. The application returns the full response body of these requests to the attacker. The issue is resolved in version 1.0.8.1 by implementing a validateUrl() check.
Affected products
- givanz Vvveb < 1.0.8.1
Timeline
- 2026-04-19: patched: Version 1.0.8.1 released
- 2026-04-20: disclosed
- 2026-04-20: advisory