# CVE-2026-54613: Vvveb path traversal in backup file handling via theme parameter

Source: https://junglewise.ai/threats/cve-2026-54613-vvveb-path-traversal-in-backup-file-handling-via-theme-parameter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-54613 · Severity: medium · CVSS 5.4 · Published 2026-09-17

Vvveb is a CMS and page builder for creating websites and e-commerce stores. An authenticated editor can exploit insufficient sanitization of the theme parameter to access or delete backup files outside the intended theme directory, potentially exposing sensitive exported site content or removing backup data.

Technologies: [Vvveb](https://junglewise.ai/threats/technologies/vvveb). Vendors: [Vvveb](https://junglewise.ai/threats/vendors/vvveb).

## Quick answers

**Is CVE-2026-54613 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54613 being exploited in the wild.

**How severe is CVE-2026-54613?** Medium severity, with a CVSS score of 5.4, published 17 September 2026.

**Which products and versions are affected?** Vvveb prior to 1.0.8.5.

**Is there a fix for CVE-2026-54613?** A patch was published on 2026-06-07: Fixed in version 1.0.8.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54613 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-54613?** Check whether you run Vvveb at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability exists in admin/controller/editor/revisions.php where the getThemeFolder() function returns an attacker-controlled theme parameter without sanitization. The vulnerability allows authenticated users with the Editor role to submit traversal sequences (e.g., ../) that redirect file_get_contents() or unlink() operations to backup subdirectories outside the web root. An admin session and valid CSRF token are required; reads are limited to .html files in backup directories, and deletion requires filesystem write permission. The root cause is insufficient input validation on the theme parameter before concatenation with DIR_THEMES. The fix, applied in version 1.0.8.5, applies sanitizeFileName() to the theme parameter to strip traversal characters.

## Affected products

- Vvveb Vvveb prior to 1.0.8.5

## Timeline

- 2026-09-17: disclosed: CVE-2026-54613 published
- 2026-06-07: patched: Fixed in version 1.0.8.5

## References

- [https://github.com/givanz/Vvveb/commit/1d76ad52402beeed623a7e386c6796126689a746](https://github.com/givanz/Vvveb/commit/1d76ad52402beeed623a7e386c6796126689a746)
- [https://github.com/givanz/Vvveb/releases/tag/1.0.8.5](https://github.com/givanz/Vvveb/releases/tag/1.0.8.5)

## Related threats

- [Vvveb CMS authentication bypass in password reset](https://junglewise.ai/threats/cve-2026-110799-vvveb-is-a-powerful-and-easy-to-use-cms-with-page-builder-to)
- [Vvveb path traversal in backup functions](https://junglewise.ai/threats/cve-2026-112904-vvveb-is-a-powerful-and-easy-to-use-cms-with-page-builder-to)
- [Vvveb SSRF via IPv6 bypass in oEmbed proxy](https://junglewise.ai/threats/cve-2026-55232-vvveb-is-a-powerful-and-easy-to-use-cms-with-page-builder-to)
- [Vvveb CMS path traversal in sanitizeFileName](https://junglewise.ai/threats/cve-2026-55231-vvveb-is-a-powerful-and-easy-to-use-cms-with-page-builder-to)
- [Vvveb stored XSS via HTML sanitizer filter bypass](https://junglewise.ai/threats/cve-2026-55230-vvveb-is-a-powerful-and-easy-to-use-cms-with-page-builder-to)