CVE-2026-112904: CWE-26: Path Traversal: '/dir/../filename' in givanz Vvveb

In Vvveb CMS versions 1.0.8.6 and prior, the nextRestore() and nextBackup() functions in the backup controller improperly handle a file GET parameter by concatenating it directly to the DIR_BACKUP path without sanitizing the file name. This path traversal vulnerability (CWE-26) enables an authenticated administrator to read arbitrary files on the server via nextRestore and write SQL dump content to arbitrary locations via nextBackup. Other sibling functions such as restore(), delete(), and download() correctly sanitize file names, highlighting inconsistent input validation. The vulnerability has been addressed and patched in commit aa29cb0.

An authenticated administrator can exploit this vulnerability to read arbitrary files on the server, potentially exposing sensitive data, and write SQL dump content to arbitrary locations, which could lead to unauthorized data modification or corruption. The vulnerability has a high CVSS score of 8.7, indicating significant confidentiality and integrity impact but no availability impact. There are no known exploits in the wild.

A patch addressing this vulnerability has been released via commit aa29cb0. Users should update to the fixed version that includes this commit to remediate the issue. Since the vulnerability requires authenticated administrator access, ensuring that only trusted administrators have access is also recommended until the patch is applied.