Quick answers
- Is CVE-2026-54507 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-54507 being exploited in the wild.
- How severe is CVE-2026-54507?
- Informational severity, with a CVSS score of 6.5, published 17 September 2026.
- Which products and versions are affected?
- Vvveb prior to 1.0.8.5.
- Is there a fix for CVE-2026-54507?
- A patch was published on 2026-06-07: Version 1.0.8.5 released with IP validation fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-54507 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-54507?
- Check whether you run Vvveb at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The oEmbedProxy() handler in admin/controller/editor/editor.php accepts an attacker-controlled url parameter and passes it to getUrl() without proper validation. The validateUrl() function in system/functions.php checks only the hostname string and does not validate the resolved IP address. An authenticated admin-panel user with editor/* permission can invoke GET /admin/index.php?module=editor/editor&action=oEmbedProxy with a crafted hostname that resolves to private, loopback, link-local, or reserved addresses, causing the server to issue HTTP/HTTPS requests and return response bodies. No CSRF token is required because the action uses GET. The vulnerability was patched in version 1.0.8.5 by adding IP address resolution checks in validateUrl().
Affected products
- Vvveb Vvveb prior to 1.0.8.5
Timeline
- 2026-09-17: disclosed
- 2026-06-07: patched: Version 1.0.8.5 released with IP validation fix