Vvveb: Path traversal in backup functions nextRestore() and nextBackup()
Summary
Vvveb, a CMS with page builder, contains a path traversal flaw in the administrative backup functions nextRestore() and nextBackup(). The file parameter is not sanitized, so an authenticated administrator can read arbitrary files on the server via nextRestore and write SQL dump content to arbitrary paths via nextBackup. Exploitation requires administrator privileges; the sources do not describe an unauthenticated attack path.
Affected
- Vvveb 1.0.8.6 and prior (CNA version range: before commit aa29cb0)
Fixed in
- Commit aa29cb0 sanitizes the backup filename.
- The GitHub advisory lists 1.0.8.7 as patched.
- Target 1.0.9.0 or later: its release notes list a follow-up fix for backslash handling in nextRestore(), which may not be in 1.0.8.7.
Workaround
- No vendor workaround documented.
- Interim measure: limit backup and restore permissions to the roles that require them.
Exploitation
- CISA SSVC: exploitation status 'poc', not automatable.
- Not listed in CISA KEV; no public exploit found in the research.
- NVD status: Deferred.
Our recommendation
- Inventory all Vvveb installations and their versions.
- Upgrade to 1.0.9.0 or later.
- Restrict admin access by IP allowlist or VPN, enforce MFA, and review admin accounts.
- Limit backup permissions to required roles.
- Review web server and application logs for unusual backup or restore requests.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-75qx-795q-v79g github.com
- Fix commit aa29cb0: Sanitize backup filename github.com
- Vvveb release 1.0.9.0 github.com
- Vulners CVE record CVE-2026-112904 vulners.com
- VulDB entry 425664 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:31.
Original description (NVD)
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. In versions 1.0.8.6 and prior, the nextRestore() and nextBackup() functions in the backup controller accept a file GET parameter and concatenate it directly to DIR_BACKUP without calling sanitizeFileName(). This allows an authenticated administrator to read arbitrary files on the server (via nextRestore) and write SQL dump content to arbitrary locations (via nextBackup). This is inconsistent with the sibling functions restore(), delete(), and download() which all correctly call sanitizeFileName() first. This issue has been patched via commit aa29cb0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.