---
id: "CVE-2026-126375"
page: "https://infrastack.ai/live/CVE-2026-126375"
kind: "vulnerability"
aliases: ["CVE-2026-126375"]
title: "Vvveb: low-privilege vendors can rename, delete or overwrite others' files"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Vvveb", "fixed": [], "affected": "<= 1.0.8.6", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["auth-required", "ecommerce", "multi-vendor", "other", "php", "self-hosted", "vvveb"]
not_affected_if: ["no-digital-products", "single-vendor-store"]
published_at: "2026-11-13T10:17:39+00:00"
first_seen_at: "2026-11-13T10:47:17+00:00"
updated_at: "2026-11-13T10:53:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126375", "first_seen_at": "2026-11-13T10:47:17+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-13T10:53:07+00:00"}]
exploit_sources: []
---

# Vvveb: low-privilege vendors can rename, delete or overwrite others' files

Link for people: https://infrastack.ai/live/CVE-2026-126375 (this .md is for agents)

Vvveb, an open-source ecommerce platform, lets a low-privilege vendor rename, delete or overwrite digital-asset files that belong to other vendors in the shared storage directory. An attacker can break other vendors' downloads or swap in malicious content.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Vvveb affected <= 1.0.8.6 fixed no fixed version listed

## How to check

Check the installed givanz/Vvveb version (composer.lock or the admin footer): <= 1.0.8.6 is affected. You are only exposed if more than one vendor account exists and vendors can reach product/digital-asset (the default Vendor role allows product/*). Digital files sit in storage/digital_assets.

## Fix

No patched version as of the GitHub advisory (patched versions: None). Until one ships, restrict the Vendor role so it cannot reach product/digital-asset/rename, delete and upload, or run a single vendor. Maintainer suggests per-vendor subdirectories or an ownership check in admin/controller/product/digital-asset.php.

## Timeline

- 2026-11-13T10:47:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126375
- 2026-11-13T10:53:07+00:00 analyst — Read GitHub GHSA-387r-2vfq-vrmf and VulnCheck: affected <=1.0.8.6, no patched version listed. Missing authz in media trait used by product/digital-asset. No check written: multi-vendor use is not readable from a repo.

## Documents

- [advisory] Vendor advisory: github.com https://github.com/givanz/Vvveb/security/advisories/GHSA-387r-2vfq-vrmf
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/vvveb-through-1.0.8.6-cross-tenant-digital-asset-tampering-via-media-trait

## From the sources

Vvveb through 1.0.8.6 contains a missing authorization vulnerability that allows low-privilege vendors to rename, delete, or overwrite other vendors' digital-asset files in the shared storage/digital_assets directory. Attackers can send rename, delete, or upload requests to product/digital-asset with another vendor's filename to break downloads or substitute malicious content.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_