givanz Vvveb Code Editor functions.php sanitizeFileName path traversal

published 2025-10-27 12 mo ago modified 2026-10-08 32 d ago also EUVD-2025-36065

cvss: 6.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 33%
public exploits: 0; none known

A weakness has been identified in givanz Vvveb up to 1.0.7.3. This issue affects the function sanitizeFileName of the file system/functions.php of the component Code Editor. Executing a manipulation of the argument File can lead to path traversal. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This patch is called b0fa7ff74a3539c6d37000db152caad572e4c39b. Applying a patch is advised to resolve this issue.

Patch / fix

links 1

github.com/givanz/Vvveb@b0fa7ff commit

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 12 mo ago (2025-10-27)

Exploit prediction

0.39% chance of exploitation in the next 30 days, higher than 33% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/givanz/Vvveb/issues/333 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CNA	3.1	6.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
CNA	3.0	6.3	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
CNA	2.0	6.5	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C
CNA	4.0	2.1	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA	3.1	6.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
NVD	3.1	4.9	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CNA	2.0	6.5	AV:N/AC:L/Au:S/C:P/I:P/A:P

Affected products

givanz Vvveb

Classification

Weakness

CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

github.com /givanz/Vvveb/commit/b0fa7ff74a3539c6d37000db152caad572e4c39b
patch
github.com /givanz/Vvveb/issues/333
exploit, issue-tracking
vuldb.com /?id.329873
vdb-entry, technical-description, third-party-advisory
vuldb.com /?ctiid.329873
signature, permissions-required, vdb-entry
vuldb.com /?submit.673159
third-party-advisory, vdb-entry
github.com /givanz/Vvveb/
product

Sources

CVE List CVE-2025-12203
NVD CVE-2025-12203

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary