Read the docs
TI-2026-39909 Aliases CVE-2026-55232

Vvveb: Server-side request forgery in Vvveb via IPv6 bypass of validateUrl() in editor oEmbed proxy

Priority HIGH 66CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb's SSRF guard resolves a host with an IPv4-only function and never inspects IPv6, so any host that lacks an A record passes a private-range check. Editor oEmbed proxy fetches an attacker-supplied URL server side and reflects a response body, so an authenticated admin-panel user (default role site_admin or higher) can read internal-only services and cloud metadata, including IAM credentials, using an IPv6 literal or a domain that carries only an AAAA record. This issue has been patched in version 1.0.8.6.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0039 33rd percentileScored 2026-11-07
Fix Fixed Vvveb (givanz): 1.0.8.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
givanzVvvebbefore 1.0.8.61.0.8.6Patch availableCNA
  • Vvveb Vendorgivanz Affected before 1.0.8.6 Fixed in 1.0.8.6 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:vvveb:vvveb:*:*:*:*:*:*:*:*——givanz
  • cpe:2.3:a:vvveb:vvveb:*:*:*:*:*:*:*:* Versions — — ·givanz

Remediation

  • Fix · CNA Vvveb (givanz) Fixed in 1.0.8.6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55232
  2. 2026-10-06 CISA SSVC decision points changed
  3. 2026-10-06 Priority changed: LOW → HIGH

References

Other 3

  • TI-2026-83112 Authentication bypass in Vvveb password reset enables account takeover CVSS 3.1CRITICAL 9.8
  • TI-2025-28570 An issue in vvveb CMS v.1.0.6 allows a remote attacker to execute arbitrary code via the Plugin mechanism. CVSS 3.1CRITICAL 9.8
  • TI-2024-18282 givanz VvvebJs 1.7.2 is vulnerable to Insecure File Upload. CVSS 3.1CRITICAL 9.8
  • TI-2024-16622 givanz VvvebJs 1.7.2 suffers from a File Upload vulnerability via save.php. CVSS 3.1CRITICAL 9.8
  • TI-2024-16621 A critical vulnerability has been identified in givanz VvvebJs 1.7.2, which allows both… CVSS 3.1CRITICAL 9.1
  • TI-2026-83115 Authenticated IDOR in Vvveb lets admins steal other admins' API tokens CVSS 3.1CRITICAL 9.0
See all 65 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences