CVE-2026-34428 is a server-side request forgery vulnerability in the Vvveb product by givanz, affecting versions prior to 1.0.8.1. The issue exists in the oEmbedProxy action within the editor/editor module, where the url parameter is passed directly to the getUrl() function using curl without validating the URL scheme or destination. This allows authenticated backend users to supply file:// URLs to read arbitrary files accessible by the web server process or http:// URLs targeting internal network addresses to probe internal services. The response bodies from these requests are returned directly to the caller, exposing potentially sensitive internal information. The vulnerability is classified under CWE-918 and has a CVSS 4.0 base score of 8.3, indicating high severity. There is no vendor advisory or patch currently available, and the product is not a cloud service.

Exploitation of this SSRF vulnerability allows authenticated backend users to read arbitrary files on the server that the web process can access, potentially exposing sensitive data. Additionally, attackers can probe internal network services by sending crafted HTTP requests to internal addresses, which may reveal information about internal infrastructure. The direct return of response bodies to the attacker increases the risk of information disclosure. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict backend user access to trusted personnel only and monitor for suspicious activity. Avoid exposing the vulnerable functionality to untrusted users. Implement network-level controls to limit the web server's ability to access internal resources if possible.