Description

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. From 1.0.0 until 1.0.8.5, saveGlobalElements() in admin/controller/editor/global-trait.php concatenates the attacker-controlled file portion of data-v-save-global to the active theme directory before loadHTMLFile() and file_put_contents() operate on it. An authenticated user with the default Editor role and editor/* permission can submit crafted HTML to module=editor/editor&action=save and traverse to an existing writable PHP file outside the theme directory. If the target is web-accessible, editor-controlled PHP content executes in the web server context; a shipped public/vadmin/index.php entrypoint can be used as an execution trampoline rather than requiring a test-only file. This can permit persistent webshell placement and compromise application confidentiality, integrity, and availability. This issue is fixed in version 1.0.8.5.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-17T22:17:01.377Z",
  "pubdate": "2026-09-17T22:17:01.377Z",
  "executiveSummary": "A critical path traversal vulnerability exists in Vvveb CMS versions 1.0.0 through 1.0.8.5, stemming from insecure file path handling within the saveGlobalElements() function.\nThe vulnerability allows an authenticated user with the 'Editor' role to manipulate file paths during the save operation, enabling the overwriting of arbitrary files on the web server.\nBy submitting a crafted payload to the 'module=editor/editor&action=save' endpoint, an attacker can traverse out of the intended theme directory and target sensitive, web-accessible PHP files.\nThe primary impact of this flaw is Remote Code Execution (RCE), as an attacker can inject malicious PHP code into existing entry points, such as 'public/vadmin/index.php'.\nSuccessful exploitation results in full compromise of application confidentiality, integrity, and availability, effectively granting the attacker control over the underlying web server context.\nThis vulnerability highlights a critical lack of input sanitization and path validation when handling file operations involving user-supplied directory strings.",
  "technicalDetails": "The vulnerability is located in 'admin/controller/editor/global-trait.php' within the 'saveGlobalElements()' function. The root cause is the insecure concatenation of attacker-controlled input, specifically the 'data-v-save-global' parameter, to the active theme directory path.\nThe application fails to sanitize or validate the provided file path, allowing an attacker to utilize directory traversal sequences (e.g., '../') to escape the restricted theme directory. This bypasses the intended directory constraints before the paths are passed to 'loadHTMLFile()' and 'file_put_contents()'.\nExploitation requires authentication as a user with the 'Editor' role and 'editor/*' permissions. An attacker initiates the attack by making a request to 'module=editor/editor&action=save'. Within the request body, the attacker manipulates the 'data-v-save-global' parameter to point to a target file outside of the web-accessible theme directory.\nThe attacker can target critical PHP files on the server. A notable target for this exploitation is 'public/vadmin/index.php'. By forcing the application to write crafted HTML or PHP content to this file, the attacker transforms it into an execution trampoline.\nBecause the server parses and executes PHP files in the web context, the injected malicious code is executed upon the next access to the targeted entry point. This effectively achieves persistent Remote Code Execution (RCE).\nPost-exploitation impact includes, but is not limited to, the execution of arbitrary system commands, unauthorized access to sensitive databases, data exfiltration, and the ability to maintain a persistent webshell on the host environment. The integrity of the application is completely compromised once the attacker is able to overwrite arbitrary system files."
}