{"id":"CVE-2026-126379","kind":"vulnerability","aliases":["CVE-2026-126379"],"related":[],"title":"Vvveb: incomplete SSRF fix lets admins reach internal services","description":"Vvveb 1.0.8.6 contains an incomplete server-side request forgery fix that allows authenticated admin users to bypass DNS pinning by requesting non-443 URLs. Attackers can supply a rebinding hostname to the editor oEmbedProxy url parameter to read loopback services, internal panels, and cloud metadata credentials.","summary":"Vvveb 1.0.8.6 has an incomplete server-side request forgery fix in the editor's oEmbed proxy. An authenticated admin can use a DNS-rebinding hostname with a non-443 port to read loopback services, internal panels and cloud metadata credentials.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Vvveb","fixed":[],"affected":"1.0.8.6","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cms","package","self-hosted","vvveb"],"not_affected_if":["auth-required","no-internal-services-reachable","no-untrusted-admins"],"how_to_check":"- Run Vvveb 1.0.8.6? Check the installed version (composer show givanz/vvveb, or the version in the admin panel). Only 1.0.8.6 is listed as affected.\n- Vulnerable code: in system/functions.php, validateUrl() builds CURLOPT_RESOLVE entries with a hard-coded ':443:' port.\n- Anyone with an admin or editor login can call /admin/index.php?module=editor/editor&action=oEmbedProxy&url=... Review who holds those accounts.\n- Check whether the Vvveb host can reach loopback services, internal panels or cloud metadata.","fix":"No patched version listed in the maintainer advisory (GHSA-42hc-694f-hcqm) as of 2026-11-13. Until one ships, restrict admin/editor access and block the Vvveb server's egress to loopback, internal ranges and 169.254.169.254 (use IMDSv2 with hop limit 1 on AWS).","status":"open","published_at":"2026-11-13T10:17:40+00:00","first_seen_at":"2026-11-13T10:47:17+00:00","triaged_at":"2026-11-13T10:51:10+00:00","updated_at":"2026-11-13T10:52:14+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-13T10:51:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Vvveb: incomplete SSRF fix lets admins reach internal services","impact":"medium","summary":"Vvveb 1.0.8.6 has an incomplete server-side request forgery fix in the editor's oEmbed proxy. An authenticated admin can use a DNS-rebinding hostname with a non-443 port to read loopback services, internal panels and cloud metadata credentials.","audience":"businesses","category":"package","nicknames":[],"who_cares":["vvveb","self-hosted","cms"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Internal services and cloud metadata credentials are readable by the attacker","analyst_note":"Confirm the fixed version and the vendor advisory at github.com; sources do not state a fix.","how_to_check":"- Check the installed Vvveb version against `1.0.8.6`\n- Review whether the editor oEmbedProxy url parameter is reachable by admin users\n- unknown","plain_action":"","product_name":"Vvveb","needs_analyst":true,"not_affected_if":["no-untrusted-admins","no-internal-services-reachable"],"who_is_affected":"Sites running Vvveb 1.0.8.6 where admin users can reach the editor's oEmbed proxy. Exposure depends on whether the server can reach loopback, internal networks or cloud metadata endpoints. Installations without admin accounts exposed to untrusted users are less at risk.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000746,"input_tokens":4615,"output_tokens":569,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and the vendor advisory at github.com; sources do not state a fix.","search":"'-126379':12A,15A '-2026':11A,14A '-443':53B,88C '1.0.8.6':24B,66C 'admin':6A,42B,79C 'allow':77C 'attack':90C 'authent':41B,78C 'bypass':82C 'cloud':62B,109C 'cms':17B 'contain':67C 'credenti':64B,111C 'cve':10A,13A 'dns':47B,83C 'dns-rebind':46B 'editor':36B,98C 'fix':4A,33B,75C 'forgeri':32B,74C 'host':21B 'hostnam':49B,95C 'incomplet':2A,27B,69C 'intern':8A,59B,106C 'let':5A 'loopback':57B,104C 'metadata':63B,110C 'non':52B,87C 'oemb':38B 'oembedproxi':99C 'packag':18B 'panel':60B,107C 'paramet':101C 'pin':84C 'port':54B 'proxi':39B 'reach':7A 'read':56B,103C 'rebind':48B,94C 'request':31B,73C,86C 'self':20B 'self-host':19B 'server':29B,71C 'server-sid':28B,70C 'servic':9A,58B,105C 'side':30B,72C 'ssrf':3A 'suppli':92C 'url':89C,100C 'use':44B 'user':80C 'vvveb':1A,16A,22B,23B,65C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Vvveb 1.0.8.6 sites. An attacker needs an authenticated admin-panel session with editor access. They give the oEmbedProxy url parameter a hostname that rebinds to an internal IP, on a non-443 port or plain http, and read the response. What they can reach depends on the server: loopback services, internal admin panels and cloud metadata credentials. Sites with only trusted admins, or with no reachable internal services or metadata endpoint, are at lower risk.","tier":"B","verified":{"fix":{"at":"2026-11-13T10:52:14Z","by":"analyst","doc":"https://github.com/givanz/Vvveb/security/advisories/GHSA-42hc-694f-hcqm","run_id":3860},"products":{"at":"2026-11-13T10:52:14Z","by":"analyst","doc":"https://github.com/givanz/Vvveb/security/advisories/GHSA-42hc-694f-hcqm","run_id":3860},"how_to_check":{"at":"2026-11-13T10:52:14Z","by":"analyst","doc":"https://github.com/givanz/Vvveb/security/advisories/GHSA-42hc-694f-hcqm","run_id":3860},"who_affected":{"at":"2026-11-13T10:52:14Z","by":"analyst","doc":"https://github.com/givanz/Vvveb/security/advisories/GHSA-42hc-694f-hcqm","run_id":3860}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["vvveb"],"ptokens":["vvveb"],"labels":["cms","high","package","selfhosted","vendor","vvveb"],"campaign_type":null,"search_a":"'-126379':12A,15A '-2026':11A,14A 'admin':6A 'cve':10A,13A 'fix':4A 'incomplet':2A 'intern':8A 'let':5A 'reach':7A 'servic':9A 'ssrf':3A 'vvveb':1A,16A","search_b":"'-443':53B '1.0.8.6':24B 'admin':42B 'authent':41B 'cloud':62B 'cms':17B 'credenti':64B 'dns':47B 'dns-rebind':46B 'editor':36B 'fix':33B 'forgeri':32B 'host':21B 'hostnam':49B 'incomplet':27B 'intern':59B 'loopback':57B 'metadata':63B 'non':52B 'oemb':38B 'packag':18B 'panel':60B 'port':54B 'proxi':39B 'read':56B 'rebind':48B 'request':31B 'self':20B 'self-host':19B 'server':29B 'server-sid':28B 'servic':58B 'side':30B 'use':44B 'vvveb':22B,23B","search_c":"'-443':88C '1.0.8.6':66C 'admin':79C 'allow':77C 'attack':90C 'authent':78C 'bypass':82C 'cloud':109C 'contain':67C 'credenti':111C 'dns':83C 'editor':98C 'fix':75C 'forgeri':74C 'hostnam':95C 'incomplet':69C 'intern':106C 'loopback':104C 'metadata':110C 'non':87C 'oembedproxi':99C 'panel':107C 'paramet':101C 'pin':84C 'read':103C 'rebind':94C 'request':73C,86C 'server':71C 'server-sid':70C 'servic':105C 'side':72C 'suppli':92C 'url':89C,100C 'user':80C 'vvveb':65C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-29T01:14:35+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126379","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126379","severity":null,"published_at":"2026-11-13T10:17:40+00:00","modified_at":"2026-11-13T10:17:40+00:00","first_seen_at":"2026-11-13T10:47:17+00:00","fetched_at":"2026-11-13T10:47:17+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126379:3860","url":null,"severity":null,"published_at":"2026-11-13T10:52:14+00:00","modified_at":"2026-11-13T10:52:14+00:00","first_seen_at":"2026-11-13T10:52:14+00:00","fetched_at":"2026-11-13T10:52:14+00:00","note":"GHSA-42hc-694f-hcqm (maintainer advisory): affected 1.0.8.6, patched versions none. VulnCheck's range '<1.0.9.0' is not a fix statement; no fixed version confirmed. Root cause: validateUrl() builds CURLOPT_RESOLVE entries for port 443 only, so non-443 URLs are not pinned."}],"documents":[{"id":144999,"url":"https://github.com/givanz/Vvveb/security/advisories/GHSA-42hc-694f-hcqm","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-29T01:14:35+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145000,"url":"https://www.vulncheck.com/advisories/vvveb-1.0.8.6-ssrf-via-oembed-proxy-dns-rebinding","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}