Executive brief
Vvveb, an open-source content management system, is vulnerable to a security flaw that allows users with basic media upload permissions to take over the entire website. By uploading a specially crafted file and renaming it, an attacker can trick an administrator's browser into executing malicious code. This can lead to the creation of unauthorized administrator accounts and full control over the server.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Vvveb versions prior to 1.0.8.1 due to insufficient validation in the media management component. Authenticated attackers with 'media/media/upload' and 'media/media/rename' permissions can bypass MIME type checks by prepending a 'GIF89a' header to a file containing HTML/JavaScript payloads. By subsequently using the rename functionality to change the file extension to '.html', the attacker can host a malicious page on the server. When an administrator visits this page, the script executes in their session context, allowing the attacker to perform administrative actions such as creating backdoor accounts or uploading malicious PHP plugins for Remote Code Execution (RCE). The issue was addressed in version 1.0.8.1 by adding '.html' to the 'uploadDenyExtensions' list.
Affected products
- givanz Vvveb < 1.0.8.1
Timeline
- 2026-03-28: disclosed: Initial discovery and report by Delta Obscura
- 2026-04-19: patched: Version 1.0.8.1 released with fix
- 2026-04-20: advisory: CVE-2026-34429 published
References
- https://delta.cyberm.ca/bugbin/ur66bvB7BYTC9y0eCIk3uzhZQgbjzAkG/
- https://github.com/givanz/Vvveb/commit/cc997d3359ea5e49a45c132f5dee3bc80fb441d7
- https://github.com/givanz/Vvveb/releases/tag/1.0.8.1
- https://github.com/givanz/Vvveb/security/advisories/GHSA-2vc4-49hq-g7f4
- https://www.vulncheck.com/advisories/vvveb-stored-xss-via-media-upload-and-rename