CVE-2026-34429 is a stored cross-site scripting vulnerability in givanz Vvveb prior to version 1.0.8.1. Authenticated users with media upload and rename permissions can bypass MIME type validation by prepending a GIF89a header to HTML/JavaScript payloads, then renaming the file to an executable extension like .html. This allows execution of arbitrary JavaScript in an administrator's browser session, potentially enabling attackers to create backdoor accounts and upload malicious plugins that facilitate remote code execution. The vulnerability is rated medium severity with a CVSS 4.0 score of 5.1. There is no vendor-provided patch or official remediation information available at this time.

Successful exploitation allows authenticated users with specific permissions to execute arbitrary JavaScript in administrator sessions, which can lead to unauthorized account creation and uploading of malicious plugins. This can result in remote code execution and compromise of the affected system. The vulnerability requires authentication and specific permissions, limiting exposure to authorized users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict media upload and rename permissions to trusted users only and monitor for suspicious file uploads or renaming activities. Consider additional application-layer controls to validate uploaded file content beyond MIME type checks.