CVE-2026-55231

Name of the Vulnerable Software and Affected Versions Vvveb versions prior to 1.0.8.6

Description A flawed central path sanitizer allows an authenticated admin-panel user with backup access (such as the site admin role or higher) to read and delete arbitrary files on the server. This can lead to the recovery of database credentials from config/db.php, the reading of sensitive host files like /etc/passwd, or the deletion of config/db.php to force the site into install mode for a complete system takeover.

Recommendations Update to version 1.0.8.6.