CVE-2026-34429
Vvveb < 1.0.8.1 Stored XSS via Media Upload and Rename
- State
- Published
- Severity
- 5.1 Medium
- Published
- Apr 20, 2026
- Updated
- Jul 28, 2026
- Reserved
- Mar 27, 2026
Description
Vvveb prior to 1.0.8.1 contains a stored cross-site scripting vulnerability that allows authenticated users with media upload and rename permissions to execute arbitrary JavaScript by bypassing MIME type validation and renaming uploaded files to executable extensions. Attackers can prepend a GIF89a header to HTML/JavaScript payloads to bypass upload validation, rename the file to .html extension, and execute malicious scripts in an administrator's browser session to create backdoor accounts and upload malicious plugins for remote code execution.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N | VulnCheck |
| 3.1 | 5.4 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N | VulnCheck |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
Vvvebgivanz |
|
References
- https://delta.cyberm.ca/bugbin/ur66bvB7BYTC9y0eCIk3uzhZQgbjzAkG/technical-descriptionexploit
- https://github.com/givanz/Vvveb/security/advisories/GHSA-2vc4-49hq-g7f4vendor-advisory
- https://github.com/givanz/Vvveb/releases/tag/1.0.8.1release-notes
- https://github.com/givanz/Vvveb/commit/cc997d3359ea5e49a45c132f5dee3bc80fb441d7patch
- https://www.vulncheck.com/advisories/vvveb-stored-xss-via-media-upload-and-renamethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.