CVE-2026-112904

The Vvveb CMS (versions 1.0.8.6 and prior) contains a Path Traversal vulnerability in the nextRestore() and nextBackup() functions of the backup controller. The root cause is the direct concatenation of a file GET parameter to DIR_BACKUP without utilizing the sanitizeFileName() function. This all...