The vulnerability is a path traversal flaw in Vvveb’s revisions controller. An attacker able to supply an unsanitized theme value can cause the application to construct file paths that traverse outside the intended themes directory, allowing an authenticated user to read or delete .html backup files. This can expose sensitive site content or remove backup data. The flaw aligns with CWE‑22, impacting confidentiality and integrity through improper input validation.

Vvveb CMS from vendor givanz, versions prior to 1.0.8.5. The issue is present in admin/controller/editor/revisions.php and has been fixed in release 1.0.8.5.

The CVSS score of 5.4 indicates moderate risk while the EPSS score of less than 1% denotes very low probability of exploitation; the vulnerability is not listed in CISA KEV. Exploitation requires a valid admin session, the default Editor role, and a correct CSRF token. Once those prerequisites are met, an attacker can traverse directories via the theme parameter to read or delete backup .html files located in subdirectories of DIR_THEMES. The path traversal is limited to backup directories but still lets the attacker reveal site content or delete backups.