PT-2026-33774 · Vvveb · Vvveb

Hamed Kohi + 1 · CVE-2026-34429 · Published 2026-04-20 · Updated 2026-04-20

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Vvveb versions prior to 1.0.8.1

Description Authenticated users with media upload and rename permissions can execute arbitrary JavaScript by bypassing MIME type validation and renaming uploaded files to executable extensions. This is achieved by prepending a GIF89a header to HTML/JavaScript payloads to bypass upload validation and then renaming the file to a '.html' extension. This allows malicious scripts to execute in an administrator's browser session, potentially leading to the creation of backdoor accounts and the upload of malicious plugins for remote code execution.

Recommendations Update to version 1.0.8.1 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-34429

GHSA-2VC4-49HQ-G7F4

Affected Products

Vvveb

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34429.json · Exploit
• 🔥 https://delta.cyberm.ca/bugbin/ur66bvB7BYTC9y0eCIk3uzhZQgbjzAkG · Exploit
• https://github.com/givanz/Vvveb/commit/cc997d3359ea5e49a45c132f5dee3bc80fb441d7 · Patch
• https://github.com/givanz/Vvveb/security/advisories/GHSA-2vc4-49hq-g7f4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-34429 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34429 · Security Note
• https://github.com/givanz/Vvveb · Note
• https://github.com/givanz/Vvveb/releases/tag/1.0.8.1 · Note
• https://vulncheck.com/advisories/vvveb-stored-xss-via-media-upload-and-rename · Note
• https://twitter.com/VulmonFeeds/status/2046290201283035606 · Twitter Post