Medium severity · published Apr 20, 2026
CVE-2026-34429
Vvveb < 1.0.8.1 Stored XSS via Media Upload and Rename
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
Vvveb prior to 1.0.8.1 contains a stored cross-site scripting vulnerability that allows authenticated users with media upload and rename permissions to execute arbitrary JavaScript by bypassing MIME type validation and renaming uploaded files to executable extensions. Attackers can prepend a GIF89a header to HTML/JavaScript payloads to bypass upload validation, rename the file to .html extension, and execute malicious scripts in an administrator's browser session to create backdoor accounts and upload malicious plugins for remote code execution.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VV
Vvveb · givanz
before 1.0.8.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-34429
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-34429
delta.cyberm.ca
https://delta.cyberm.ca/bugbin/ur66bvB7BYTC9y0eCIk3uzhZQgbjzAkG/
github.com
https://github.com/givanz/Vvveb/commit/cc997d3359ea5e49a45c132f5dee3bc80fb441d7
github.com
https://github.com/givanz/Vvveb/releases/tag/1.0.8.1
github.com
https://github.com/givanz/Vvveb/security/advisories/GHSA-2vc4-49hq-g7f4
www.vulncheck.com
https://www.vulncheck.com/advisories/vvveb-stored-xss-via-media-upload-and-rename
More from Vvveb
9.8
CVE-2026-41930
Vvveb < 1.0.8.2 Hard-coded Credentials Information Disclosure via phpMyAdmin
9.8
CVE-2026-39918
Vvveb < 1.0.8.1 Code Injection via Installation Endpoint
9.8
CVE-2025-9397
givanz Vvveb media.php unrestricted upload
8.8
CVE-2026-54612
Vvveb: Authenticated editor path traversal to PHP file write/RCE via data-v-save-global
8.8
CVE-2026-49228
Vvveb product authorization bypass allows Vendors to read, duplicate, or delete other Vendors' products