Executive brief
Vvvebjs is a drag-and-drop page builder library used to create web content. A security flaw in its file upload component allows attackers to upload malicious files that can execute scripts in a user's browser. This could lead to unauthorized actions being performed on behalf of users or the theft of sensitive session information.
Technical details
A cross-site scripting (XSS) vulnerability exists in the upload.php file of the Vvvebjs File Upload Endpoint. The root cause is the inclusion of the 'svg' extension in the $uploadAllowExtensions whitelist, which allows attackers to upload SVG files containing malicious JavaScript. When a user or administrator views the uploaded file, the script executes in the context of their browser session. This is a remote attack requiring minimal user interaction. The issue has been addressed in commit 8cac22cff99b8bc701c408aa8e887fa702755336 by removing 'svg' from the allowed extensions list.
Affected products
- givanz Vvvebjs up to 2.0.5
Timeline
- 2026-04-06: disclosed
- 2026-04-06: advisory
- 2026-04-06: patched