CVE-2026-54612 Vvveb: Authenticated editor path traversal to PHP file write/RCE via data-v-save-global
Authenticated editors can exploit path traversal in Vvveb CMS to write PHP files, leading to remote code execution and full application compromise.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-54612?
CVE-2026-54612 is a high-severity path traversal vulnerability in givanz Vvveb, published on 17 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. From 1.0.0 until 1.0.8.5, saveGlobalElements() in admin/controller/editor/global-trait.php concatenates the attacker-controlled file portion of data-v-save-global to the active theme directory before loadHTMLFile() and file_put_contents() operate on it. An authenticated user with the default Editor role and editor/* permission can submit crafted HTML to module=editor/editor&action=save and traverse to an existing writable PHP file outside the theme directory. If the target is web-accessible, editor-controlled PHP content executes in the web server context; a shipped public/vadmin/index.php entrypoint can be used as an execution trampoline rather than requiring a test-only file. This can permit persistent webshell placement and compromise application confidentiality, integrity, and availability. This issue is fixed in version 1.0.8.5.
Which versions are affected by CVE-2026-54612?
How do I fix CVE-2026-54612?
No fix has been published for CVE-2026-54612 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-54612 being exploited?
There is no known exploitation of CVE-2026-54612 in the wild and no public exploit code.
Sources
Also known as GHSA-c3v9-3xrq-pvqv.