Executive brief
Vvveb, an open-source content management system and website builder, contains a critical security flaw in its installation process. An attacker can exploit this to take complete control of the web server without needing a username or password. This could lead to the theft of sensitive customer data, full website defacement, or the use of the server for further malicious activities.
Technical details
A code injection vulnerability exists in Vvveb versions prior to 1.0.8.1 within the installation endpoint. The root cause is the lack of sanitization, escaping, or validation of the 'subdir' POST parameter before it is written to the 'env.php' configuration file. An unauthenticated remote attacker can provide a specially crafted 'subdir' value to break out of the PHP string context in a 'define' statement. This allows the injection of arbitrary PHP code, leading to remote code execution (RCE) with the privileges of the web server user. The issue is addressed in version 1.0.8.1 by implementing proper filename sanitization.
Affected products
- givanz Vvveb < 1.0.8.1
Timeline
- 2026-04-19: patched: Version 1.0.8.1 released
- 2026-04-20: advisory: CVE published and VulnCheck advisory released