CVE-2025-8518 givanz Vvveb Code Editor code.php save code injection

Medium 5.1 Published 4 Aug 2025 Updated 5 Aug 2025

Remote attackers with permissions can inject malicious code via the Code Editor save function, leading to arbitrary code execution.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-8518?

CVE-2025-8518 is a medium-severity code injection vulnerability in givanz Vvveb, published on 4 Aug 2025. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A vulnerability was found in givanz Vvveb 1.0.5. It has been rated as critical. Affected by this issue is the function Save of the file admin/controller/editor/code.php of the component Code Editor. The manipulation leads to code injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.6 is able to address this issue. The name of the patch is f684f3e374d04db715730fc4796e102f5ebcacb2. It is recommended to upgrade the affected component.

Weakness: CWE-94, CWE-74

Which versions are affected by CVE-2025-8518?

It affects 1 product.

Products include Vvveb Vvveb.

How do I fix CVE-2025-8518?

No fix has been published for CVE-2025-8518 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2025-8518 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-8518 exists.

Public exploit code: 1 Metasploit module and 2 proofs of concept on GitHub.

Sources

Also known as GHSA-6mmr-q9x7-2592.