VVVEB · CVE-2026-126375 · Other
NO FIX YET · SEE WHAT TO DO
Vvveb, an open-source ecommerce platform, lets a low-privilege vendor rename, delete or overwrite digital-asset files that belong to other vendors in the shared storage directory. An attacker can break other vendors' downloads or swap in malicious content.
first public Oct 29, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted multi-vendor Vvveb stores up to 1.0.8.6 that sell digital downloads. Any low-privilege vendor account can rename, delete or overwrite other vendors' files in the shared storage/digital_assets directory, so customers get broken or attacker-supplied downloads. Single-vendor stores and stores with no digital products can skip it.
Not affected if no-digital-products, single-vendor-store
Who cares auth-required, ecommerce, multi-vendor, php, self-hosted, vvveb
1.0.8.6 is affectedVvveb through 1.0.8.6 contains a missing authorization vulnerability that allows low-privilege vendors to rename, delete, or overwrite other vendors' digital-asset files in the shared storage/digital_assets directory. Attackers can send rename, delete, or upload requests to product/digital-asset with another vendor's filename to break downloads or substitute malicious content.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.