Vulnerability · Published Sep 17, 2026 · Assigned by GitHub_M

CVE-2026-54612Vvveb: Authenticated editor path traversal to PHP file write/RCE via data-v-save-global

High 8.8

In plain English

A high-severity path traversal in Vvveb from givanz. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 55% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.8%top 44.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. From 1.0.0 until 1.0.8.5, saveGlobalElements() in admin/controller/editor/global-trait.php concatenates the attacker-controlled file portion of data-v-save-global to the active theme directory before loadHTMLFile() and file_put_contents() operate on it. An authenticated user with the default Editor role and editor/* permission can submit crafted HTML to module=editor/editor&action=save and traverse to an existing writable PHP file outside the theme directory. If the target is web-accessible, editor-controlled PHP content executes in the web server context; a shipped public/vadmin/index.php entrypoint can be used as an execution trampoline rather than requiring a test-only file. This can permit persistent webshell placement and compromise application confidentiality, integrity, and availability. This issue is fixed in version 1.0.8.5.

Affected products (as reported)

Vendor	Product	Versions
givanz	Vvveb	>= 1.0.0, < 1.0.8.5

Weakness: CWE-22, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/givanz/Vvveb/security/advisories/GHSA-c3v9-3xrq-pvqv x_refsource_CONFIRM
https://github.com/givanz/Vvveb/commit/c8fef41ad8651d348050c513451755ab8882b97e x_refsource_MISC
https://github.com/givanz/Vvveb/releases/tag/1.0.8.5 x_refsource_MISC