Vvveb prior to 1.0.8.1 contains a server-side request forgery vulnerability in the oEmbedProxy action of the editor/editor module where the url parameter is pas…

Vvveb prior to version 1.0.8.1 contains a server-side request forgery (SSRF) vulnerability in the oEmbedProxy action of the editor/editor module. The vulnerability occurs when the url parameter is passed directly to getUrl() via curl without proper scheme or destination validation. Authenticated backend users can exploit this by supplying file:// URLs to read arbitrary files accessible to the web server process or http:// URLs targeting internal network addresses to probe internal services. The response bodies from these requests are returned directly to the caller, making this a significant security risk for information disclosure and internal network reconnaissance.