CVE-2026-112904

highpriority · track · 0EPSS 0.003 · 27 %ile

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.34% (27th) EPSS

CVSS 8.7 · high

Is it mine?

0 products

Check your exposure

Who says so?

— sources

EPSS · scored 2026-10-27

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. In versions 1.0.8.6 and prior, the nextRestore() and nextBackup() functions in the backup controller accept a file GET parameter and concatenate it directly to DIR_BACKUP without calling sanitizeFileName(). This allows an authenticated administrator to read arbitrary files on the server (via nextRestore) and write SQL dump content to arbitrary locations (via nextBackup). This is inconsistent with the sibling functions restore(), delete(), and download() which all correctly call sanitizeFileName() first. This issue has been patched via commit aa29cb0.

cvss

Technical severity, 0–10. One row per scoring source.

8.7

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.18.7highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Nsecondary · security-advisories@github.comexploitability 2.3 · impact 5.8

v3.18highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-26USprimary

affected products

Products and version ranges known to be affected.

No affected products recorded.

sources

Which sources assert this record, and when.

NVD CVE.org MITRE

published 2026-10-23modified 2026-10-23

related (19)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2024-25466US	high7.8	0.54% (45th)	Exploit	2024-02-16
Directory Traversal vulnerability in React Native Document Picker before v.9.1.1 and fixed in v.9.1.1 allows a local attacker to execute arbitrary code via a crafted script to the…
CVE-2026-15896US	critical9.1	0.88% (59th)	—	2026-10-02
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.316 via the parse_request function. T…
CVE-2021-34762US	high8.1	1.99% (81st)	—	2021-10-27
A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to perform a directory trave…
CVE-2023-50255US	high7.8	1.05% (64th)	—	2023-12-27
Deepin-Compressor is the default archive manager of Deepin Linux OS. Prior to 5.12.21, there's a path traversal vulnerability in deepin-compressor that can be exploited to achieve…
CVE-2021-42021US	high7.5	1.74% (78th)	—	2021-11-09
A vulnerability has been identified in Siveillance Video DLNA Server (2019 R1), Siveillance Video DLNA Server (2019 R2), Siveillance Video DLNA Server (2019 R3), Siveillance Video…

+14 more

references (2) nvd

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan