CVE-2026-34429: Givanz Vvveb stored XSS via media upload and rename bypass

CVE-2026-34429 · Severity: medium · CVSS 5.4 · Published 2026-04-20

Vvveb, an open-source content management system, is vulnerable to a security flaw that allows users with basic media upload permissions to take over the entire website. By uploading a specially crafted file and renaming it, an attacker can trick an administrator's browser into executing malicious code. This can lead to the creation of unauthorized administrator accounts and full control over the server.

Technologies: Givanz VvvebJs. Vendors: Givanz.

Quick answers

Is CVE-2026-34429 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-34429 being exploited in the wild.
How severe is CVE-2026-34429?
Medium severity, with a CVSS score of 5.4, published 20 April 2026.
Which products and versions are affected?
givanz Vvveb < 1.0.8.1.
Is there a fix for CVE-2026-34429?
A patch was published on 2026-04-19: Version 1.0.8.1 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34429 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-34429?
Check whether you run Givanz VvvebJs. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in Vvveb versions prior to 1.0.8.1 due to insufficient validation in the media management component. Authenticated attackers with 'media/media/upload' and 'media/media/rename' permissions can bypass MIME type checks by prepending a 'GIF89a' header to a file containing HTML/JavaScript payloads. By subsequently using the rename functionality to change the file extension to '.html', the attacker can host a malicious page on the server. When an administrator visits this page, the script executes in their session context, allowing the attacker to perform administrative actions such as creating backdoor accounts or uploading malicious PHP plugins for Remote Code Execution (RCE). The issue was addressed in version 1.0.8.1 by adding '.html' to the 'uploadDenyExtensions' list.

Affected products

  • givanz Vvveb < 1.0.8.1

Timeline

  • 2026-03-28: disclosed: Initial discovery and report by Delta Obscura
  • 2026-04-19: patched: Version 1.0.8.1 released with fix
  • 2026-04-20: advisory: CVE-2026-34429 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.