{"id":"CVE-2026-126375","kind":"vulnerability","aliases":["CVE-2026-126375"],"related":[],"title":"Vvveb: low-privilege vendors can rename, delete or overwrite others' files","description":"Vvveb through 1.0.8.6 contains a missing authorization vulnerability that allows low-privilege vendors to rename, delete, or overwrite other vendors' digital-asset files in the shared storage/digital_assets directory. Attackers can send rename, delete, or upload requests to product/digital-asset with another vendor's filename to break downloads or substitute malicious content.","summary":"Vvveb, an open-source ecommerce platform, lets a low-privilege vendor rename, delete or overwrite digital-asset files that belong to other vendors in the shared storage directory. An attacker can break other vendors' downloads or swap in malicious content.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Vvveb","fixed":[],"affected":"<= 1.0.8.6","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["auth-required","ecommerce","multi-vendor","other","php","self-hosted","vvveb"],"not_affected_if":["no-digital-products","single-vendor-store"],"how_to_check":"Check the installed givanz/Vvveb version (composer.lock or the admin footer): <= 1.0.8.6 is affected. You are only exposed if more than one vendor account exists and vendors can reach product/digital-asset (the default Vendor role allows product/*). Digital files sit in storage/digital_assets.","fix":"No patched version as of the GitHub advisory (patched versions: None). Until one ships, restrict the Vendor role so it cannot reach product/digital-asset/rename, delete and upload, or run a single vendor. Maintainer suggests per-vendor subdirectories or an ownership check in admin/controller/product/digital-asset.php.","status":"open","published_at":"2026-11-13T10:17:39+00:00","first_seen_at":"2026-11-13T10:47:17+00:00","triaged_at":"2026-11-13T10:52:23+00:00","updated_at":"2026-11-13T10:53:07+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-11-13T10:52:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Vvveb: low-privilege vendors can rename, delete or overwrite others' files","impact":"medium","summary":"Vvveb, an open-source ecommerce platform, lets a low-privilege vendor rename, delete or overwrite digital-asset files that belong to other vendors in the shared storage directory. An attacker can break other vendors' downloads or swap in malicious content.","audience":"businesses","category":"other","nicknames":[],"who_cares":["vvveb","self-hosted","ecommerce"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"other vendors' digital files deleted or replaced with malicious content","analyst_note":"Confirm affected versions and fix from the vendor advisory at github.com and the VulnCheck advisory; NVD data gives only through 1.0.8.6.","how_to_check":"unknown","plain_action":"","product_name":"Vvveb","needs_analyst":true,"not_affected_if":["single-vendor-store","no-digital-products"],"who_is_affected":"Sites running Vvveb through 1.0.8.6 with multiple vendor accounts that sell digital downloads are exposed, because vendors share the storage/digital_assets directory. The sources do not say which configurations beyond that are affected. unknown","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000717,"input_tokens":4622,"output_tokens":510,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected versions and fix from the vendor advisory at github.com and the VulnCheck advisory; NVD data gives only through 1.0.8.6.","search":"'-126375':15A,18A '-2026':14A,17A '1.0.8.6':78C 'allow':85C 'anoth':117C 'asset':52B,99C 'attack':65B,106C 'auth':21B 'auth-requir':20B 'author':82C 'belong':55B 'break':67B,122C 'contain':79C 'content':75B,127C 'cve':13A,16A 'delet':8A,47B,92C,110C 'digit':51B,98C 'digital-asset':50B,97C 'directori':63B,105C 'download':70B,123C 'ecommerc':23B,38B 'file':12A,53B,100C 'filenam':120C 'host':31B 'let':40B 'low':3A,43B,87C 'low-privileg':2A,42B,86C 'malici':74B,126C 'miss':81C 'multi':25B 'multi-vendor':24B 'open':36B 'open-sourc':35B 'other':11A 'overwrit':10A,49B,94C 'php':28B 'platform':39B 'privileg':4A,44B,88C 'product/digital-asset':115C 'renam':7A,46B,91C,109C 'request':113C 'requir':22B 'self':30B 'self-host':29B 'send':108C 'share':61B,103C 'sourc':37B 'storag':62B 'storage/digital_assets':104C 'substitut':125C 'swap':72B 'upload':112C 'vendor':5A,26B,45B,58B,69B,89C,96C,118C 'vulner':83C 'vvveb':1A,19A,32B,33B,76C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted multi-vendor Vvveb stores up to 1.0.8.6 that sell digital downloads. Any low-privilege vendor account can rename, delete or overwrite other vendors' files in the shared storage/digital_assets directory, so customers get broken or attacker-supplied downloads. Single-vendor stores and stores with no digital products can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-13T10:53:07Z","by":"analyst","doc":"https://github.com/givanz/Vvveb/security/advisories/GHSA-387r-2vfq-vrmf","run_id":3865},"products":{"at":"2026-11-13T10:53:07Z","by":"analyst","doc":"https://github.com/givanz/Vvveb/security/advisories/GHSA-387r-2vfq-vrmf","run_id":3865},"how_to_check":{"at":"2026-11-13T10:53:07Z","by":"analyst","doc":"https://github.com/givanz/Vvveb/security/advisories/GHSA-387r-2vfq-vrmf","run_id":3865},"who_affected":{"at":"2026-11-13T10:53:07Z","by":"analyst","doc":"https://github.com/givanz/Vvveb/security/advisories/GHSA-387r-2vfq-vrmf","run_id":3865}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["vvveb"],"ptokens":["vvveb"],"labels":["authrequired","ecommerce","high","multivendor","other","php","selfhosted","vendor","vvveb"],"campaign_type":null,"search_a":"'-126375':15A,18A '-2026':14A,17A 'cve':13A,16A 'delet':8A 'file':12A 'low':3A 'low-privileg':2A 'other':11A 'overwrit':10A 'privileg':4A 'renam':7A 'vendor':5A 'vvveb':1A,19A","search_b":"'asset':52B 'attack':65B 'auth':21B 'auth-requir':20B 'belong':55B 'break':67B 'content':75B 'delet':47B 'digit':51B 'digital-asset':50B 'directori':63B 'download':70B 'ecommerc':23B,38B 'file':53B 'host':31B 'let':40B 'low':43B 'low-privileg':42B 'malici':74B 'multi':25B 'multi-vendor':24B 'open':36B 'open-sourc':35B 'overwrit':49B 'php':28B 'platform':39B 'privileg':44B 'renam':46B 'requir':22B 'self':30B 'self-host':29B 'share':61B 'sourc':37B 'storag':62B 'swap':72B 'vendor':26B,45B,58B,69B 'vvveb':32B,33B","search_c":"'1.0.8.6':78C 'allow':85C 'anoth':117C 'asset':99C 'attack':106C 'author':82C 'break':122C 'contain':79C 'content':127C 'delet':92C,110C 'digit':98C 'digital-asset':97C 'directori':105C 'download':123C 'file':100C 'filenam':120C 'low':87C 'low-privileg':86C 'malici':126C 'miss':81C 'overwrit':94C 'privileg':88C 'product/digital-asset':115C 'renam':91C,109C 'request':113C 'send':108C 'share':103C 'storage/digital_assets':104C 'substitut':125C 'upload':112C 'vendor':89C,96C,118C 'vulner':83C 'vvveb':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-29T01:15:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126375","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126375","severity":null,"published_at":"2026-11-13T10:17:39+00:00","modified_at":"2026-11-13T10:17:40+00:00","first_seen_at":"2026-11-13T10:47:17+00:00","fetched_at":"2026-11-13T10:47:17+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126375:3865","url":null,"severity":null,"published_at":"2026-11-13T10:53:07+00:00","modified_at":"2026-11-13T10:53:07+00:00","first_seen_at":"2026-11-13T10:53:07+00:00","fetched_at":"2026-11-13T10:53:07+00:00","note":"Read GitHub GHSA-387r-2vfq-vrmf and VulnCheck: affected <=1.0.8.6, no patched version listed. Missing authz in media trait used by product/digital-asset. No check written: multi-vendor use is not readable from a repo."}],"documents":[{"id":144991,"url":"https://github.com/givanz/Vvveb/security/advisories/GHSA-387r-2vfq-vrmf","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-29T01:15:36+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144992,"url":"https://www.vulncheck.com/advisories/vvveb-through-1.0.8.6-cross-tenant-digital-asset-tampering-via-media-trait","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}