CVE-2026-34429 is a stored cross-site scripting vulnerability in the givanz Vvveb product prior to version 1.0.8.1. Authenticated users with permissions to upload and rename media files can bypass MIME type validation by prepending a GIF89a header to crafted HTML/JavaScript payloads, then renaming the uploaded file to an executable extension such as .html. This allows execution of arbitrary JavaScript in the context of an administrator's browser session. The malicious script can be used to create backdoor accounts and upload malicious plugins, potentially leading to remote code execution. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The CVSS 4.0 score is 5.1, indicating medium severity. There is no vendor advisory or patch available at this time, and the product is not a cloud service.

Successful exploitation allows authenticated users with media upload and rename permissions to execute arbitrary JavaScript in administrator sessions. This can lead to privilege escalation through creation of backdoor accounts and uploading malicious plugins, which may enable remote code execution. The vulnerability compromises the integrity and security of the affected system by allowing persistent malicious code execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict media upload and rename permissions to trusted users only. Monitor for suspicious file uploads and consider implementing additional validation controls on uploaded content. Avoid using affected versions in sensitive environments where possible.