VULNERABILITY INTELLIGENCE

CVE-2026-34428

CVSS score8.3 HIGH
EPSS probability0.26%
CISA KEVNot currently listed
Published2026-04-20
Last modified2026-10-26
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Description

Vvveb prior to 1.0.8.1 contains a server-side request forgery vulnerability in the oEmbedProxy action of the editor/editor module where the url parameter is passed directly to getUrl() via curl without scheme or destination validation. Authenticated backend users can supply file:// URLs to read arbitrary files readable by the web server process or http:// URLs targeting internal network addresses to probe internal services, with response bodies returned directly to the caller.

Weakness classification

  • CWE-918: Server-Side Request Forgery (SSRF)

Primary references