Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-54507— Vvveb oEmbedProxy vulnerable to server-side request forgery

Quick assessment

Affected
givanz Vvveb
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Vvveb 是一款功能强大且易于使用的 CMS，内置页面构建器，可用于构建网站、博客或电子商务商店。在 1.0.8.5 之前的版本中，admin/controller/editor/editor.php 文件中的 oEmbedProxy() 处理函数接受由攻击者控制的 url 参数，并将其传递给 getUrl() 函数；同时，system/functions.php 中的 validateUrl() 函数仅检查主机名字符串，而不验证其解析后的 IP 地址。因此，拥有 editor/* 权限的已认证后台管理用户可以通

CVSS 8.4 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-54507

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Vvveb oEmbedProxy vulnerable to server-side request forgery
Source: CVE Program / CVE List V5
Vulnerability Description
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, the oEmbedProxy() handler in admin/controller/editor/editor.php accepts an attacker-controlled url parameter and passes it to getUrl(), while validateUrl() in system/functions.php checks only the hostname string and does not validate its resolved addresses. An authenticated admin-panel user with editor/* permission can invoke GET /admin/index.php?module=editor/editor&action=oEmbedProxy with a dotted hostname or normalized loopback form that resolves to a private, loopback, link-local, or reserved address, causing the server to issue an HTTP or HTTPS request and return the response body. Storefront users and anonymous visitors cannot invoke the endpoint, but no CSRF token is required because the action uses GET. This can disclose internal service responses or cloud instance metadata and associated credentials. This issue is fixed in version 1.0.8.5.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
givanz Vvveb < 1.0.8.5 -

II. Public POCs for CVE-2026-54507

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-54507

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-54507 (1)

Vendor Advisories for CVE-2026-54507 (1)

Vendor Pages for CVE-2026-54507 (1)

Same Patch Batch · givanz · 2026-09-17 · 4 CVEs total

CVE-2026-54612 8.8 HIGH Vvveb: Authenticated editor path traversal to PHP file write/RCE via data-v-save-global
CVE-2026-54506 7.6 HIGH Vvveb: Stored XSS via sanitizeHTML() bypass in user profile bio field
CVE-2026-54613 5.4 MEDIUM Vvveb: Path Traversal in Revision Backup Reader/Deleter via Unsanitized theme Parameter

IV. Related Vulnerabilities

Same product: Vvveb
Same vendor: givanz
Same weakness: CWE-918

V. Comments for CVE-2026-54507

No comments yet

Leave a comment