---
id: CVE-2026-54613
title: >-
  Vvveb is a powerful and easy to use CMS with page builder to build websites,
  blogs or ecommerce stores
summary: >-
  Vvveb is a powerful and easy to use CMS with page builder to build websites,
  blogs or ecommerce stores. Prior to 1.0.8.5, getThemeFolder() in
  admin/controller/editor/revisions.php returns the attacker-controlled theme
  parameter without s…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-22
vendor: givanz
product: Vvveb
affected:
  - Vvveb < 1.0.8.5
published: '2026-09-17'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T02:16:32.197'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54613'
references:
  - url: >-
      https://github.com/givanz/Vvveb/commit/1d76ad52402beeed623a7e386c6796126689a746
    label: security-advisories@github.com
  - url: 'https://github.com/givanz/Vvveb/releases/tag/1.0.8.5'
    label: security-advisories@github.com
  - url: 'https://github.com/givanz/Vvveb/security/advisories/GHSA-gjxp-vrcw-69v8'
    label: security-advisories@github.com
  - url: 'https://github.com/givanz/Vvveb/security/advisories/GHSA-gjxp-vrcw-69v8'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-22T01:55:03.952801Z'
epss: 0.00341
epssPercentile: 0.24863
ingestedAt: '2026-09-17T22:30:21.401Z'
---

## Overview

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, getThemeFolder() in admin/controller/editor/revisions.php returns the attacker-controlled theme parameter without sanitization, and backupFolder() concatenates it beneath DIR_THEMES before editor/revisions/load or editor/revisions/delete operates on a named .html file. sanitizeBackupFileName() strips traversal characters only from the separate file parameter and does not protect the theme directory component. An authenticated user with the default Editor role and editor/* permission can submit traversal sequences that redirect file_get_contents() or unlink() to a reachable backup subdirectory outside the web root. A valid admin session and CSRF token are required, the read is limited to .html files in backup directories, and deletion additionally requires filesystem write permission. This can disclose sensitive exported site content or remove backup data. This issue is fixed in version 1.0.8.5.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.