CVE-2026-55232

Name of the Vulnerable Software and Affected Versions Vvveb versions prior to 1.0.8.6

Description The SSRF guard in the CMS resolves hosts using an IPv4-only function and fails to inspect IPv6 addresses. Consequently, any host lacking an A record bypasses the private-range check. An authenticated user with admin-panel privileges (role site admin or higher) can exploit the Editor oEmbed proxy to fetch an attacker-supplied URL server-side. By using an IPv6 literal or a domain with only an AAAA record, the user can read internal-only services and cloud metadata, such as IAM credentials. SSRF (Server-Side Request Forgery) is a flaw where a server is tricked into making requests to an unintended location.

Recommendations Update to version 1.0.8.6.