CVE-2026-54613

Executive Summary

CVE-2026-54613 is a path traversal vulnerability (CWE-22) in Vvveb CMS prior to version 1.0.8.5, where the theme parameter consumed by getThemeFolder() in admin/controller/editor/revisions.php is returned unsanitized and concatenated beneath the DIR_THEMES constant by backupFolder(). An authenticated user holding the default Editor role with editor/* permission can redirect file_get_contents() or unlink() operations to reachable backup subdirectories outside the web root, enabling disclosure of exported site content or deletion of backup data. Impact is bounded — read access is limited to .html files within backup directories, deletion additionally requires filesystem write permission, and a valid admin session plus CSRF token are prerequisites — yielding a CVSS 3.1 base score of 5.4 (Medium).

Technical Analysis

The vulnerable code path resides in admin/controller/editor/revisions.php, a file within Vvveb's admin controller layer. Two functions are central to the flaw:

1. getThemeFolder() — accepts and returns the attacker-controlled theme parameter without sanitization. No normalization, whitelist validation, or traversal-character stripping is applied to this value.
2. backupFolder() — concatenates the unsanitized theme value beneath the DIR_THEMES constant, producing an effective path used by the subsequent file operation.

The controller endpoints editor/revisions/load and editor/revisions/delete then perform filesystem operations (file_get_contents() for load, unlink() for delete) against a named .html file resolved inside the incorrectly-derived backup folder.

The critical defect is an asymmetric sanitization boundary: sanitizeBackupFileName() strips traversal characters (../-style sequences) from the separate file parameter, but this protection is never applied to the theme directory component. Because backupFolder() builds the final path from DIR_THEMES + attacker-controlled theme, an authenticated actor can inject traversal sequences into theme to escape the intended theme directory and point the backup folder at a different, reachable backup subdirectory outside the web root. The filename parameter is defanged, but the directory prefix is not — classic incomplete-input-canonicalization.

Attack surface characteristics:

• Authentication required: the attacker needs a valid session and the editor/* permission (granted to the default Editor role).
• CSRF protection: a valid CSRF token is required, meaning the request must originate from an authenticated context with a legitimate token.
• Operation constraints: read operations are limited to .html files residing in backup directories; delete operations additionally require filesystem write permission on the target.
• Vector: AV:N — remotely reachable over the network; AC:L — no unusual preconditions beyond the credentials described; PR:L — low privilege (Editor role); UI:N — no user interaction required once authenticated.

Insufficient technical detail is available to specify exact traversal payload syntax, the precise relative path depth between DIR_THEMES and any reachable backup subdirectory, or which specific backup artifacts exist in a default installation. These are installation-dependent and are not disclosed in the NVD description.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template exists for this CVE. The attack chain below is inferred strictly from the vulnerability class (CWE-22) and the mechanics stated in the NVD description.

1. Reconnaissance / target identification. Identify internet- or intranet-exposed Vvveb CMS deployments running a version below 1.0.8.5. Confirm the admin interface is reachable and that the deployment exposes the editor/revisions load/delete endpoints. Fingerprinting can leverage the admin path and CMS-specific HTML markers.

2. Prerequisite acquisition. The attacker must possess a valid authenticated session with at least the default Editor role (which carries editor/* permission) and must obtain a valid CSRF token for the request. This means the attack is a post-authentication, credentialed attack — it is not remotely exploitable by an anonymous party.

3. Triggering the flaw (path traversal class). The attacker crafts a request to editor/revisions/load (or .../delete) supplying:

   • a theme parameter containing directory traversal sequences to escape DIR_THEMES and descend into a reachable backup subdirectory; and
   • a file parameter naming a .html target (this parameter passes through sanitizeBackupFileName(), so traversal is stripped here — the exploitation lever is the theme component). Because getThemeFolder() returns theme unsanitized and backupFolder() concatenates it under DIR_THEMES, the resolved backup folder points outside the intended theme directory.

4. Execution / effect.

   • Disclosure (load): file_get_contents() reads the resolved .html file, exposing sensitive exported site content stored in backup directories.
   • Destruction (delete): unlink() removes the resolved .html backup file. This path requires filesystem write permission on the target and is therefore environment-dependent.

5. Post-exploitation. Depending on the contents of exposed .html backups (exported site content may include configuration-adjacent data, published content, or other sensitive material), an attacker could pivot toward further reconnaissance or data theft. Deletion of backups degrades an organization's recovery posture and may disrupt integrity of retained artifacts. Scope remains confined (S:U) — no stated privilege escalation or code execution.

Impact Assessment

Business impact. Two primary effects: (1) confidentiality loss — disclosure of exported site content stored in .html backups, which may reveal sensitive organizational material; and (2) integrity loss — destruction of backup data, weakening recovery capability and potentially violating retention/compliance obligations.

CVSS 3.1 subscores and rationale (base 5.4, Medium):

• AV:N (network) — reachable via HTTP(S) admin endpoints.
• AC:L (low complexity) — no special conditions beyond crafting a traversal value.
• PR:L (low privileges) — requires only the default Editor role, not administrative privileges.
• UI:N (none) — no victim interaction required.
• S:U (unchanged) — impact confined to the vulnerable component's security scope.
• C:L (low confidentiality) — read is constrained to .html files within backup directories.
• I:L (low integrity) — deletion constrained, conditional on filesystem write permission.
• A:N (none) — no availability impact stated.

Blast radius. Limited to the specific Vvveb instance and its backup directory contents. The requirement for authenticated Editor access plus a valid CSRF token substantially narrows the exploitable population to malicious or compromised low-privileged insiders, or externally-held Editor credentials. CISA KEV status: NO — no confirmed exploitation in the wild. EPSS: not scored by FIRST.org at the time of writing.

Detection Guidance

Sigma Rule

title: Vvveb CMS Path Traversal in Editor Revisions (CVE-2026-54613)
id: 9f3c1a72-4b8e-4d21-9a6f-2c7d5e8f1b04
status: experimental
description: Detects traversal sequences in the theme parameter targeting Vvveb editor/revisions load or delete endpoints.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-54613
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-stem|contains:
      - '/editor/revisions/load'
      - '/editor/revisions/delete'
  selection_traversal:
    cs-uri-query|contains:
      - '../'
      - '..%2f'
      - '%2e%2e%2f'
      - '..%5c'
      - '%2e%2e%5c'
  condition: selection_uri and selection_traversal
fields:
  - c-ip
  - cs-uri-query
  - cs-username
level: high
tags:
  - attack.t1190
  - cve.2026-54613

YARA Rule

rule CVE_2026_54613_Vvveb_Path_Traversal
{
    meta:
        description = "Detects traversal payloads targeting Vvveb CMS editor/revisions theme parameter (CVE-2026-54613)"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-54613"
        date = "2026-01-01"
        severity = "medium"
    strings:
        $endpoint1 = "editor/revisions/load" ascii nocase
        $endpoint2 = "editor/revisions/delete" ascii nocase
        $theme = "theme=" ascii nocase
        $trav1 = "../" ascii
        $trav2 = "..%2f" ascii nocase
        $trav3 = "%2e%2e%2f" ascii nocase
        $trav4 = "..\\" ascii
    condition:
        ($endpoint1 or $endpoint2) and $theme and any of ($trav*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-54613 Vvveb CMS editor/revisions theme path traversal attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/editor/revisions/"; nocase; http.uri; content:"theme="; nocase; http.uri; pcre:"/theme=(?:[^&]*)(?:\.\.(?:\/|%2f|%5c)|\/\.\.\/|%2e%2e%2f)/i"; reference:cve,2026-54613; classtype:web-application-attack; sid:2026546130; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

sequence by user.name with maxspan=30s
  [ network where url.path : ("*editor/revisions/load*" or "*editor/revisions/delete*") and url.query : ("*theme=*") ]
  [ network where url.query : ("*../*", "*..%2f*", "*%2e%2e%2f*") and url.path : ("*editor/revisions*") ]

Splunk SPL Query

index=web sourcetype=access_combined
  (uri_path="*editor/revisions/load*" OR uri_path="*editor/revisions/delete*")
  (uri_query="*../*" OR uri_query="*..%2f*" OR uri_query="*%2e%2e%2f*" OR uri_query="*%2e%2e%5c*" OR uri_query="*theme=*")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_query) as queries by src_ip, uri_path, user
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,vvveb,cve-2026-54613,">
  <rule id="100613" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>editor/revisions/(load|delete)</url>
    <match>theme=</match>
    <regex>\.\.(%2f|%5c|/)|%2e%2e%2f|%2e%2e%5c</regex>
    <description>CVE-2026-54613: Vvveb CMS editor/revisions theme path traversal attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor advisory URL, commit hash, or workaround is available in the tracked intelligence. The NVD description states the issue is fixed in version 1.0.8.5; however, no source-level patch evidence confirms this.

1) Immediate mitigations

• Restrict the Editor role: audit user accounts carrying editor/* permission and revoke it from any user who does not strictly require it (principle of least privilege). This is the primary compensating control, since the flaw is post-authentication.
• Enforce CSRF token validity strictly and monitor issuance/reuse anomalies; though the flaw requires a valid token, degrade any means of token acquisition.
• If not operationally required, disable the editor/revisions load/delete functionality at the reverse proxy (block requests matching /editor/revisions/(load|delete)).
• Ensure backup directory contents are not stored in webreachable directories wherever the deployment allows configuration; reduce the sensitivity of data retained in .html backups.

2) Patch / upgrade steps

• Upgrade Vvveb CMS to version 1.0.8.5 or later, per the NVD description. Verify the release artifact against the vendor's official distribution channel.
• Because no independent patch evidence is tracked (0/4), validate the fix in a staging environment by confirming the theme value is sanitized/canonicalized before concatenation beneath DIR_THEMES and that sanitizeBackupFileName() semantics are applied to the directory component as well.
• Re-scan after upgrade to confirm the affected endpoint no longer honors traversal sequences.

3) Long-term hardening

• Adopt canonicalization + allowlist validation for all user-influenced path components (both directory and filename), not filename-only.
• Separate backup storage from the application tree and locate it outside the web root by design.
• Enforce least privilege on filesystem accounts running the CMS so unlink() capabilities are tightly scoped.
• Deploy WAF rules matching the Suricata/Sigma detections above as defense-in-depth until patched.
• Establish a vulnerability management cadence to catch post-auth flaws that privileged insiders or leaked Editor credentials can reach.

References

• NVD — CVE-2026-54613: https://nvd.nist.gov/vuln/detail/CVE-2026-54613
• MITRE CWE-22 (Improper Limitation of a Pathname to a Restricted Directory): https://cwe.mitre.org/data/definitions/22.html
• MITRE ATT&CK T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/
• Vvveb CMS project (official distribution / release notes for version 1.0.8.5): https://www.vvveb.com
• FIRST EPSS (score not yet available for this CVE): https://www.first.org/epss

Threat actor / exploit-in-the-wild status: No CISA KEV listing, no public PoC, no exploit code, and no Nuclei template were identified for CVE-2026-54613. No known threat actor campaign is associated with this CVE at the time of writing. Detection guidance above is derived from the vulnerability class and the mechanics explicitly stated in the NVD description; no fabricated implementation details have been introduced.