Live › vulnerability › CVE-2026-112904
Go to dashboardVvveb, a PHP content management system, fails to sanitize a file parameter in its backup restore and backup functions. An logged-in administrator can read arbitrary files from the server and write SQL dump content to arbitrary paths.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Unknown from the sources.
1.0.8.6 and prior are affectedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. In versions 1.0.8.6 and prior, the nextRestore() and nextBackup() functions in the backup controller accept a file GET parameter and concatenate it directly to DIR_BACKUP without calling sanitizeFileName(). This allows an authenticated administrator to read arbitrary files on the server (via nextRestore) and write SQL dump content to arbitrary locations (via nextBackup). This is inconsistent with the sibling functions restore(), delete(), and download() which all correctly call sanitizeFileName() first. This issue has been patched via commit aa29cb0.
This page as .md · .json · in your agent: get_signal("CVE-2026-112904")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.