CVE-2026-34428 is a server-side request forgery vulnerability in the givanz Vvveb product prior to version 1.0.8.1. The issue exists in the oEmbedProxy action of the editor/editor module where the url parameter is directly passed to getUrl() using curl without validating the URL scheme or destination. Authenticated backend users can exploit this to read arbitrary files on the server via file:// URLs or to send requests to internal network addresses via http:// URLs, with the response bodies returned to the attacker. This can lead to unauthorized information disclosure and internal network reconnaissance.

The vulnerability allows authenticated backend users to read arbitrary files accessible by the web server and to probe internal network services by sending crafted requests. This can result in unauthorized disclosure of sensitive information and potential mapping of internal network infrastructure. There is no indication of remote unauthenticated exploitation or privilege escalation beyond the authenticated backend user level. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict backend user access to trusted personnel only and monitor usage of the oEmbedProxy functionality. Avoid exposing sensitive internal services that could be targeted via SSRF. Do not rely on generic mitigations as the vulnerability specifically involves URL validation in the oEmbedProxy action.