CVE-2026-54612

Executive Summary

CVE-2026-54612 is a path traversal vulnerability in Vvveb CMS affecting versions 1.0.0 through 1.0.8.4. An authenticated user holding the default Editor role (with editor/* permission) can submit crafted HTML to the editor save endpoint and cause saveGlobalElements() to operate on an arbitrary writable PHP file outside the active theme directory. Successful exploitation permits persistent webshell placement and full compromise of application confidentiality, integrity, and availability, as reflected in the CVSS 3.1 base score of 8.8.

Technical Analysis

Vvveb is a CMS that provides a page builder for websites, blogs, and ecommerce stores. The vulnerable component resides in the admin editor subsystem within admin/controller/editor/global-trait.php. The function saveGlobalElements() processes attacker-supplied input tied to a data-v-save-global attribute. The vulnerability mechanism is a classic path traversal (CWE-22): the attacker-controlled file portion of data-v-save-global is concatenated directly onto the active theme directory path. Because the concatenated value is never canonicalized or constrained to remain inside the theme root, an attacker can supply traversal sequences so the resulting path resolves to a file located outside the theme directory.

The traversed path is then passed to loadHTMLFile() and file_put_contents(). This pairing is what elevates an ordinary traversal into a write-what-where primitive:

• loadHTMLFile() reads the contents of the (traversed) target file into the HTML processing pipeline.
• file_put_contents() writes content back to that same resolved path.

The consequence is that the content the attacker submits to module=editor/editor&action=save can be written into an arbitrary existing writable PHP file. The description explicitly notes the traversal targets an existing writable PHP file — meaning the attacker does not create a new file, but overwrites one already present on disk and writable by the web server user.

The attack surface is the administrative editor endpoint (module=editor/editor&action=save), reachable over the network. The privilege requirement is low relative to impact: the default Editor role with editor/* permission suffices. No user interaction is required, and the exposed component is the application itself (CVSS scope unchanged). The injection of attacker-controlled PHP content into a web-accessible file produces code execution in the web server context. The description further notes a shipped public/vadmin/index.php entrypoint can serve as an execution trampoline — i.e., an existing, always-present web-accessible PHP file that can be turned into the execution target, removing the need for any test-only or otherwise incidental writable file to be present.

The root cause is missing path confinement: path concatenation without realpath() validation, without rejecting ../ sequences, and without verifying the final resolved path stays within the theme directory before loadHTMLFile() and file_put_contents() are invoked.

Exploitation Scenarios

No public PoC or exploit code is available; the attack chain below is inferred from the vulnerability class (CWE-22) and the explicit technical details in the NVD description.

1. Reconnaissance / target identification. An attacker identifies a network-accessible Vvveb instance running a version between 1.0.0 and 1.0.8.4. Because the exploit requires authentication, the attacker must first obtain valid credentials for a low-privileged account — the default Editor role holds the necessary editor/* permission.

2. Triggering the flaw class. With an Editor session established, the attacker submits crafted HTML to the editor save endpoint module=editor/editor&action=save. The payload carries a data-v-save-global value whose file portion contains directory-traversal sequences. saveGlobalElements() in admin/controller/editor/global-trait.php concatenates this attacker-controlled file portion onto the active theme directory, producing a path that resolves outside the theme root.

3. Payload / execution method (vulnerability-class level). The traversed path must reference an existing writable PHP file that is web-accessible. The description identifies the shipped public/vadmin/index.php entrypoint as a viable execution trampoline, so the target need not be a test-only or incidental file. The attacker injects PHP content into that file via the save operation, and the file is subsequently requested over HTTP so the injected PHP executes in the web server context.

4. Post-exploitation impact. Because the injected content is written to a persistent file, this yields a persistent webshell. From there, the attacker can compromise application confidentiality (read stored data and configuration), integrity (modify application content and code), and availability (disrupt or destroy the application), consistent with the C:H/I:H/A:H subscores in the 8.8 CVSS base score.

Impact Assessment

The CVSS 3.1 base score is 8.8 (High). Subscores: Attack Vector Network (AV:N), Attack Complexity Low (AC:L), Privileges Required Low (PR:L), User Interaction None (UI:N), Scope Unchanged (S:U), Confidentiality High (C:H), Integrity High (I:H), Availability High (A:H). The high impact subscore triad reflects that successful exploitation yields code execution under the web server account, giving the attacker direct control over the affected application. The PR:L rating recognizes the authentication requirement; however, the default Editor role is a non-administrative, commonly provisioned role, so the practical barrier is modest.

Business impact centers on full application compromise for any Vvveb deployment running an affected version where an attacker can obtain Editor-level access. Blast radius is bounded by the web server's privileges and filesystem access — but because the target is application code executed in the web server context, the attacker can pivot to any resource the web server can reach, including application data stores, configuration, and files writable by that account. Persistent webshell placement means compromise survives process restarts and cannot be cleared by simply reverting application state; it requires file-level remediation. CISA KEV status is NO and no public PoC or Nuclei template exists, indicating exploitation is not yet known to be widespread or weaponized in tracked sources. EPSS has not yet been scored by FIRST.org.

Detection Guidance

Sigma Rule

title: Vvveb CMS Path Traversal to Webshell via Global Elements Save
id: 8f2c1a44-9b7e-4d1a-9c3e-54612vvveb
status: experimental
description: Detects path traversal attempts against the Vvveb editor save endpoint targeting data-v-save-global
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-54612
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-method: 'POST'
    cs-uri-query|contains:
      - 'module=editor/editor'
      - 'action=save'
  selection_traversal:
    - cs-uri-query|contains: 'data-v-save-global'
    - cs-body|contains: 'data-v-save-global'
  selection_dotdot:
    - cs-body|contains: '../'
    - cs-uri-query|contains: '../'
    - cs-body|contains: '..%2f'
    - cs-body|contains: '..%5c'
  condition: selection_endpoint and selection_traversal and selection_dotdot
falsepositives:
  - Legitimate theme asset names containing encoded sequences
level: high

YARA Rule

rule CVE_2026_54612_Vvveb_Webshell
{
    meta:
        description = "Detects PHP webshell content written via Vvveb path traversal (CVE-2026-54612)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-54612"
        date = "2026-01-01"
        severity = "high"

    strings:
        $php_open  = "<?php"
        $eval      = "eval("
        $system    = "system("
        $exec      = "exec("
        $shell_exec = "shell_exec("
        $passthru  = "passthru("
        $base64    = "base64_decode("
        $assert    = "assert("
        $global    = "data-v-save-global"

    condition:
        filesize < 2MB and
        $php_open and
        (
            2 of ($eval, $system, $exec, $shell_exec, $passthru, $base64, $assert)
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-54612 Vvveb CMS Path Traversal via data-v-save-global"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"module=editor/editor"; http.uri; content:"action=save"; http.request_body; content:"data-v-save-global"; nocase; http.request_body; content:"../"; distance:0; pcre:"/(\.\.\/|\.\.%2f|\.\.%5c)/iU"; reference:cve,2026-54612; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-54612; classtype:web-application-attack; sid:2026546120; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=10s
  [process where event.type == "start" and process.name in ("php", "php-fpm", "apache2", "httpd") and process.args : "*vadmin*"]
  [file where event.action in ("creation", "modification") and file.path : "*vadmin/index.php" and file.extension == "php"]

Splunk SPL Query

index=web sourcetype=access_common
| search (cs_method=POST) (uri_query="*module=editor/editor*" OR uri_query="*action=save*")
| rex field=uri_query "(?<rawpayload>data-v-save-global[^&]*)"
| where match(rawpayload, "(?i)(\.\./|\.\.%2f|\.\.%5c)")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_query) as payloads by src_ip, uri_path
| sort - count

Wazuh OSSEC Rule

<group name="web,vvveb,cve-2026-54612,">
  <rule id="100546120" level="12">
    <decoded_as>json</decoded_as>
    <match>data-v-save-global</match>
    <regex>\.\.(/|%2f|%5c)</regex>
    <description>CVE-2026-54612: Vvveb path traversal attempt via data-v-save-global on editor save endpoint</description>
    <mitre>
      <id>T1505.003</id>
    </mitre>
    <group>web_attack,</group>
  </rule>

  <rule id="100546121" level="14">
    <if_sid>100546120</if_sid>
    <match>action=save</match>
    <description>CVE-2026-54612: Likely successful Vvveb editor save traversal — follow-up webshell write possible</description>
    <group>web_attack,persistence,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence was found from any tracked source, though the NVD description states the issue is fixed in version 1.0.8.5; treat patch availability as vendor-asserted but unverified by tracked sources.

1. Immediate mitigations.

   • Restrict access to the administrative editor endpoint (module=editor/editor&action=save) to trusted networks only; do not expose the Vvveb admin interface directly to the internet.
   • Minimize use of the Editor role and audit all accounts holding editor/* permission. Disable or downgrade unnecessary Editor accounts.
   • Ensure PHP files that should not be writable (including shipped entrypoints such as public/vadmin/index.php) are owned by a user other than the web server account and mounted read-only where feasible.
   • Apply a web application firewall (WAF) rule that inspects data-v-save-global values and blocks traversal sequences (../, ..%2f, ..%5c).

2. Patch / upgrade steps.

   • Upgrade to Vvveb version 1.0.8.5 per the vendor-acknowledged fix. Because patch confidence is low (0/4), verify the fix in a staging environment by confirming the resolved behavior of saveGlobalElements() no longer permits traversal outside the theme directory, and confirm the deployed artifact version.
   • If upgrading is not immediately possible, apply the immediate mitigations above as compensating controls.

3. Long-term hardening.

   • Enforce canonical path validation (realpath()) and confine all file operations to the theme root, rejecting inputs that resolve outside allowed directories.
   • Apply a default-deny allowlist for writable files and directories reachable by editor operations.
   • Run the web server with least privilege and segregate PHP execution permissions from application data writability.
   • Implement file integrity monitoring (FIM) on application PHP files, especially public/vadmin/index.php, to detect unauthorized modification.
   • Monitor authentication logs for suspicious use of Editor accounts.

References

• NVD — CVE-2026-54612: https://nvd.nist.gov/vuln/detail/CVE-2026-54612
• CWE-22 — Path Traversal: https://cwe.mitre.org/data/definitions/22.html
• MITRE ATT&CK T1505.003 — Web Shell: https://attack.mitre.org/techniques/T1505/003/
• Vvveb project (upstream project referenced by the CNA description) — vendor fix in version 1.0.8.5
• CISA KEV catalog — status: NOT listed (no exploitation in the wild confirmed in tracked sources)

Threat actor campaign evidence: none available in tracked sources. No public PoC, no Nuclei template, and no exploit code were identified. EPSS has not yet been scored by FIRST.org.