CVE-2026-34428

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34428", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-03-27T15:24:06.752Z", "datePublished": "2026-04-20T13:55:36.802Z", "dateUpdated": "2026-11-08T14:02:08.447Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-08T14:02:08.447Z"}, "datePublic": "2026-04-17T00:00:00.000Z", "title": "Vvveb < 1.0.8.1 SSRF via oEmbedProxy", "descriptions": [{"lang": "en", "value": "Vvveb prior to\u00a01.0.8.1 contains a server-side request forgery vulnerability in the oEmbedProxy action of the editor/editor module where the url parameter is passed directly to getUrl() via curl without scheme or destination validation. Authenticated backend users can supply file:// URLs to read arbitrary files readable by the web server process or http:// URLs targeting internal network addresses to probe internal services, with response bodies returned directly to the caller."}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-918", "description": "Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "affected": [{"vendor": "givanz", "product": "Vvveb", "repo": "https://github.com/givanz/Vvveb", "versions": [{"status": "affected", "version": "0", "lessThan": "1.0.8.1", "versionType": "custom"}, {"status": "unaffected", "version": "2d356844f37819bf771e7cd5e12a8686975e0b2b", "versionType": "git"}], "defaultStatus": "unaffected", "packageURL": "pkg:github/givanz/Vvveb"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:vvveb:vvveb:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.0.8.1"}]}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "version": "3.1", "baseSeverity": "HIGH", "baseScore": 7.7, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"}}], "references": [{"url": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.1", "name": "Vvveb 1.0.8.1 Release Notes", "tags": ["release-notes"]}, {"url": "https://github.com/givanz/Vvveb/commit/2d356844f37819bf771e7cd5e12a8686975e0b2b", "tags": ["patch"]}, {"url": "https://www.vulncheck.com/advisories/vvveb-ssrf-via-oembedproxy", "tags": ["third-party-advisory"]}], "credits": [{"lang": "en", "value": "Hamed Kohi of Delta Obscura", "type": "finder"}, {"lang": "en", "value": "VulnCheck", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-20T14:44:41.884576Z", "id": "CVE-2026-34428", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T14:49:33.646Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34428", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-20T14:44:41.884576Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T14:49:28.127Z"}}], "cna": {"title": "Vvveb < 1.0.8.1 SSRF via oEmbedProxy", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Hamed Kohi of Delta Obscura"}, {"lang": "en", "type": "coordinator", "value": "VulnCheck"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/givanz/Vvveb", "vendor": "givanz", "product": "Vvveb", "versions": [{"status": "affected", "version": "0", "lessThan": "1.0.8.1", "versionType": "custom"}, {"status": "unaffected", "version": "2d356844f37819bf771e7cd5e12a8686975e0b2b", "versionType": "git"}], "packageURL": "pkg:github/givanz/Vvveb", "defaultStatus": "unaffected"}], "datePublic": "2026-04-17T00:00:00.000Z", "references": [{"url": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.1", "name": "Vvveb 1.0.8.1 Release Notes", "tags": ["release-notes"]}, {"url": "https://github.com/givanz/Vvveb/commit/2d356844f37819bf771e7cd5e12a8686975e0b2b", "tags": ["patch"]}, {"url": "https://www.vulncheck.com/advisories/vvveb-ssrf-via-oembedproxy", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "Vvveb prior to\u00a01.0.8.1 contains a server-side request forgery vulnerability in the oEmbedProxy action of the editor/editor module where the url parameter is passed directly to getUrl() via curl without scheme or destination validation. Authenticated backend users can supply file:// URLs to read arbitrary files readable by the web server process or http:// URLs targeting internal network addresses to probe internal services, with response bodies returned directly to the caller."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "Server-Side Request Forgery (SSRF)"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vvveb:vvveb:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.0.8.1"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-08T14:02:08.447Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34428", "state": "PUBLISHED", "dateUpdated": "2026-11-08T14:02:08.447Z", "dateReserved": "2026-03-27T15:24:06.752Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-04-20T13:55:36.802Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/givanz/Vvveb", "product": "Vvveb", "repo": "https://github.com/givanz/Vvveb", "vendor": "givanz", "versions": [{"lessThan": "1.0.8.1", "status": "affected", "version": "0", "versionType": "custom"}, {"status": "unaffected", "version": "2d356844f37819bf771e7cd5e12a8686975e0b2b", "versionType": "git"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Vvveb prior to\u00a01.0.8.1 contains a server-side request forgery vulnerability in the oEmbedProxy action of the editor/editor module where the url parameter is passed directly to getUrl() via curl without scheme or destination validation. Authenticated backend users can supply file:// URLs to read arbitrary files readable by the web server process or http:// URLs targeting internal network addresses to probe internal services, with response bodies returned directly to the caller."}, {"lang": "es", "value": "Vvveb anterior a 1.0.8.1 contiene una vulnerabilidad de falsificaci\u00f3n de petici\u00f3n del lado del servidor en la acci\u00f3n oEmbedProxy del m\u00f3dulo editor/editor donde el par\u00e1metro url se pasa directamente a getUrl() a trav\u00e9s de curl sin validaci\u00f3n de esquema o destino. Usuarios autenticados del backend pueden proporcionar URLs file: // para leer archivos arbitrarios legibles por el proceso del servidor web o URLs http:// dirigidas a direcciones de red internas para sondear servicios internos, con los cuerpos de respuesta devueltos directamente al llamador."}], "id": "CVE-2026-34428", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 4.0, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34428", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-20T14:44:41.884576Z", "version": "2.0.3"}}]}, "published": "2026-04-20T16:16:44.473", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/givanz/Vvveb/commit/2d356844f37819bf771e7cd5e12a8686975e0b2b"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.1"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/vvveb-ssrf-via-oembedproxy"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.0.8.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "code_commit", "value": "2d356844f37819bf771e7cd5e12a8686975e0b2b"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Vvveb", "source": "cna", "vendor": "givanz"}, "product": "vvveb", "vendor": "givanz"}], "analysis": {"en": {"generated_at": "2026-04-20T15:20:49.045473+00:00", "value": {"mitigation_remediation": ["Upgrade Vvveb to version 1.0.8.1 or later as released by givanz.", "Restrict editor/backend access to a trusted internal network and enforce strong authentication to reduce the opportunity set.", "Disable or remove the oEmbedProxy functionality if it is not required for the installation, thereby eliminating the entry point for the request forgery."], "summary": {"action": "Apply Patch", "impact": "Server-Side Request Forgery"}, "threat_synthesis": {"affected_systems": "This flaw affects the Vvveb web-content management system from givanz. Versions prior to 1.0.8.1 are vulnerable; later releases contain the fix.", "description_and_impact": "Vvveb versions earlier than 1.0.8.1 contain a server-side request forgery in the editor/editor module when a backend authenticated user supplies an arbitrary URL to the oEmbedProxy action. The supplied URL is passed unvalidated to a curl call, allowing web-server readable files to be read via file:// URLs or internal HTTP requests to probe the internal network. The vulnerability can leak sensitive files or network information, exposing confidential data but not enabling direct code execution. It is identified as CWE-918.", "risk_and_exploitability": "The CVSS score of 8.3 marks the issue as high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Attack requires authenticated backend access; therefore external attackers would need to compromise valid credentials. Once exploited, an attacker could read arbitrary files or enumerate internal services, giving significant confidentiality damage."}}}}, "created": "2026-04-20T15:30:06.165503+00:00", "updated": "2026-04-20T16:00:10.262975+00:00", "vendors": ["givanz", "givanz$PRODUCT$vvveb"]}