Vvveb CMS Path Traversal in Backup Functions

Vvveb CMS versions 1.0.8.6 and prior contain a critical path traversal vulnerability in the backup controller's nextRestore() and nextBackup() functions. The vulnerability stems from inadequate input validation—the functions concatenate user-supplied file parameters directly to DIR_BACKUP without sanitizing filenames, allowing authenticated administrators to bypass intended file access restrictions. This affects organizations using Vvveb to manage websites, blogs, and e-commerce platforms. An attacker with admin credentials can exploit this to read sensitive files from the server (including configuration files, source code, and data) and write malicious SQL dumps to arbitrary filesystem locations, potentially leading to remote code execution, data exfiltration, or system compromise.

Casky's skills, powered by Claude AI's extended reasoning capabilities, would detect this vulnerability pattern by correlating input validation weaknesses with file operation anomalies. A practitioner using Casky would identify findings related to T1083 (File and Directory Discovery) when monitoring for unusual file access patterns in backup directories, and T1041 (Exfiltration Over C2 Channel) indicators when SQL dumps are written to unexpected locations. The platform's 754 mapped security skills would flag insufficient input sanitization patterns, absence of path normalization functions, and direct parameter concatenation in file operations—all hallmarks of path traversal attacks. Practitioners would see alerts highlighting the lack of sanitizeFileName() calls and the dangerous concatenation of user input with directory paths, enabling rapid identification and remediation before exploitation occurs.