Medium severity · published Apr 6, 2026
CVE-2026-5615
givanz Vvvebjs File Upload Endpoint upload.php cross site scripting
4.3
CVSS
0.8%
EPSS
No
On KEV
Description
A weakness has been identified in givanz Vvvebjs up to 2.0.5. The affected element is an unknown function of the file upload.php of the component File Upload Endpoint. This manipulation of the argument uploadAllowExtensions causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. Patch name: 8cac22cff99b8bc701c408aa8e887fa702755336. Applying a patch is the recommended action to fix this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VV
Vvvebjs · givanz
2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-5615
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-5615
github.com
https://github.com/givanz/VvvebJs/
github.com
https://github.com/givanz/VvvebJs/commit/8cac22cff99b8bc701c408aa8e887fa702755336
tcn60zf28jhk.feishu.cn
https://tcn60zf28jhk.feishu.cn/wiki/Cr4KwMPiMi65fFkI9Vyc3oX2n0f?from=from_copylink
vuldb.com
https://vuldb.com/submit/785563
vuldb.com
https://vuldb.com/vuln/355406
vuldb.com
https://vuldb.com/vuln/355406/cti
More from Vvvebjs
6.5
CVE-2024-29272
Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute arbitrary code and obtain sensitive information via the…
6.1
CVE-2024-29271
Reflected Cross-Site Scripting (XSS) vulnerability in VvvebJs before version 1.7.7, allows remote attackers to execute arbitrary code and obtain sensitive information via the…
5.0
CVE-2025-8522
givanz Vvvebjs node.js save.php path traversal