Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-5615: givanz Vvvebjs file upload lets attackers run scripts

CVE-2026-5615 · published 7 months ago

Summary

The file upload feature in givanz Vvvebjs (up to version 2.0.5) can be tricked into inserting harmful code that runs in users' browsers. This could let an attacker display false information or steal data from visitors. Install the provided patch as soon as possible to stop the risk.

Original advisory text

givanz Vvvebjs File Upload Endpoint upload.php cross site scripting

A weakness has been identified in givanz Vvvebjs up to 2.0.5. The affected element is an unknown function of the file upload.php of the component File Upload Endpoint. This manipulation of the argument uploadAllowExtensions causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. Patch name: 8cac22cff99b8bc701c408aa8e887fa702755336. Applying a patch is the recommended action to fix this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

References

https://github.com/givanz/VvvebJs/ URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5615.j... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-5615 Vendor Advisory
https://vuldb.com/submit/785563 Vendor Advisory
https://vuldb.com/vuln/355406 Vendor Advisory
https://vuldb.com/vuln/355406/cti Third Party Advisory
https://github.com/givanz/VvvebJs/commit/8cac22cff99b8bc701c408aa8e887fa70275533... Patch
https://tcn60zf28jhk.feishu.cn/wiki/Cr4KwMPiMi65fFkI9Vyc3oX2n0f?from=from_copyli... Exploit

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

CWE-94Code Injection

Timeline

Published6 Apr 2026

Updated4 Nov 2026

First seen6 Apr 2026

Sources

CVE-2026-5615 · NVD

CVE-2026-5615 · OSV

Track software like this

Free during beta