The vulnerability in Vvveb 1.0.8.6 and earlier allows a privileged administrator to supply a filename via the nextRestore() function, which is concatenated to the backup directory path without sanitization. This flaw lets the attacker read arbitrary files on the server. Likewise, nextBackup() accepts SQL dump content and writes it to any location chosen by the attacker, enabling data exfiltration or further compromise. The flaw aligns with CWE-26, an example of path traversal vulnerabilities.

Vvveb CMS versions 1.0.8.6 and below. The affected vendor is givanz. The issue exists in the backup controller component of the CMS and affects any installation that has enabled backup or restoration features.

The CVSS score of 8.7 classifies this as a high‑severity issue. EPSS data is not available, and the vulnerability is not listed in CISA KEV, suggesting no known public exploit. The attack requires an authenticated administrator, so the risk is limited to environments where such privileges exist. An attacker with admin rights can read critical configuration files, secrets, or any file on the server, and can also overwrite or inject arbitrary files via the backup mechanism, potentially leading to data leakage or subsequent attacks.