CVE-2026-112904

highPriorität · verfolgen · 0EPSS 0.003 · 27. Perzentil

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.34% (27th) EPSS

CVSS 8.7 · high

Is it mine?

0 products

Prüfe deine Angriffsfläche

Who says so?

— sources

EPSS · bewertet 2026-10-27

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. In versions 1.0.8.6 and prior, the nextRestore() and nextBackup() functions in the backup controller accept a file GET parameter and concatenate it directly to DIR_BACKUP without calling sanitizeFileName(). This allows an authenticated administrator to read arbitrary files on the server (via nextRestore) and write SQL dump content to arbitrary locations (via nextBackup). This is inconsistent with the sibling functions restore(), delete(), and download() which all correctly call sanitizeFileName() first. This issue has been patched via commit aa29cb0.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

8.7

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.18.7highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Nsecondary · security-advisories@github.comAusnutzbarkeit 2.3 · Auswirkung 5.8

v3.18highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-26USprimär

betroffene Produkte

Betroffene Produkte und Versionsbereiche.

Keine betroffenen Produkte erfasst.

quellen

Welche Quellen diesen Datensatz belegen und wann.

NVD CVE.org MITRE

veröffentlicht 2026-10-23geändert 2026-10-23

verwandt (19)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2024-25466US	high7.8	0.54% (45th)	Exploit	2024-02-16
Directory Traversal vulnerability in React Native Document Picker before v.9.1.1 and fixed in v.9.1.1 allows a local attacker to execute arbitrary code via a crafted script to the…
CVE-2026-15896US	critical9.1	0.88% (59th)	—	2026-10-02
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.316 via the parse_request function. T…
CVE-2021-34762US	high8.1	1.99% (81st)	—	2021-10-27
A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to perform a directory trave…
CVE-2023-50255US	high7.8	1.05% (64th)	—	2023-12-27
Deepin-Compressor is the default archive manager of Deepin Linux OS. Prior to 5.12.21, there's a path traversal vulnerability in deepin-compressor that can be exploited to achieve…
CVE-2021-42021US	high7.5	1.74% (78th)	—	2021-11-09
A vulnerability has been identified in Siveillance Video DLNA Server (2019 R1), Siveillance Video DLNA Server (2019 R2), Siveillance Video DLNA Server (2019 R3), Siveillance Video…

+14 weitere

Referenzen (2) nvd

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan