A flaw in Vvveb’s path sanitization allows an authenticated admin‑panel user with backup access to read and delete any file on the server. The attacker may extract database credentials from config/db.php, read sensitive host files such as /etc/passwd, or remove configuration files to force the site into install mode and potentially gain full control. This vulnerability is a classic path traversal weakness and is identified as CWE‑22.

The vulnerability affects all installations of the Vvveb content management system prior to version 1.0.8.6. Administrators with the default site_admin role or higher who can perform backup operations are specifically at risk.

The CVSS score of 7.2 reflects a high severity, but the EPSS score is not available, indicating limited publicly known exploitation data. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires authenticated admin privileges and the ability to trigger backup functions, so it is not a remote, unauthenticated attack. Nonetheless, once in scope an attacker can read sensitive configuration files, extract credentials, and delete critical files to pivot to a full site takeover.