1.0.8.1

givanz/Vvveb1.0.8.1Apr 19, 2026by givanz

AI Summary

Adds comprehensive multi-language support features, including additional languages on install and language slugs. It features a new Users list component and fixes carousel bugs, while patching critical RCE and SSRF vulnerabilities.

Key Highlights

  • Add additional languages on install and homepage option.
  • Fixed renamed failing to prevent rename to restricted file extensions.
  • Deny phtml extension for media library upload and html extension for media library.
  • Fixed Authenticated SSRF via 'oEmbedProxy' and Privilege Escalation vulnerabilities.

New Features

  • Additional languages on install
  • Users list component
  • Language slug support
  • SSRF and Privilege Escalation fixes

Full Release Notes

* Add additional languages on install page (https://github.com/givanz/Vvveb/commit/f85ca7c2bc389bda3cc2eca87b2514581a628c32)
* Include nav element for page update when loading partial page content through fetch (https://github.com/givanz/Vvveb/commit/184ca3976f3b110b9b1942eddf4b5f3124fdcba1)
* Return language slug column as language to avoid conflict with post slug (https://github.com/givanz/Vvveb/commit/52d9fb307ff9f1dfa3ce1a190360a539421109aa)
* Theme install unzip bug in some hosting configuration fix (https://github.com/givanz/Vvveb/commit/399b74b0a742eb1709efbb02d29eca00aa0aca78)
* Theme update (https://github.com/givanz/Vvveb/commit/2e678d47616d2bacbcaacee9df0cad321f8ce33e)
* New escape vtpl macro (https://github.com/givanz/Vvveb/commit/7c74f1a716aaef7bc1528a50cab372dbab0e6dad)
* Fixed carousel bugs and added slide settings for mobile and tablet, added youtube background option for sections (https://github.com/givanz/Vvveb/commit/c810c533ddfcaef04a4943a2f57e7f3e3c3fe0f0)
* Set user id to 0 if anonymous comment (https://github.com/givanz/Vvveb/commit/1322d08cdc52379805c5c0964ec550320cbf05b3)
* Delete user address method (https://github.com/givanz/Vvveb/commit/545f809223972df9bf9fb4eb60f736ad3ad829e7)
* Add active class for active language and currency (https://github.com/givanz/Vvveb/commit/e7d9c13213ff6128014bec56effbc01b3e3c3529)
* Don't add page for page 1 for pagination (https://github.com/givanz/Vvveb/commit/b4834cec132af1d7f853fc0957af2fb10dfb1754)
* Homepage option and add additional languages on install page (https://github.com/givanz/Vvveb/commit/d32ce504e911aef7aac33dd6906c90956a9c2646)
* Users list component (https://github.com/givanz/Vvveb/commit/3a8ac28339b0cf5a1ef3f09e310b928cf1ed9f49)
* Product tag (https://github.com/givanz/Vvveb/commit/759e3b25a9acdfe4340643f7a0dde1c68bbb3e86)
* Check mtime instead of adding expire time in file name (https://github.com/givanz/Vvveb/commit/88569fd2149eacd988de0eae174cf5052984d6a3)
* Set relative path for url's inside style attribute (https://github.com/givanz/Vvveb/commit/df1c3e89852d60a8894375cab571da8b1252d0d1)
* App support for generating controller and actions list (https://github.com/givanz/Vvveb/commit/b2834d899e38527d20e35bfd4cf907d63d82ffa2)
* Generate temp name and store in storage folder if php native tempnam is blocked on shared hosting (https://github.com/givanz/Vvveb/commit/2710897dcefe1d6c03ccab169d6ba4260556f856)
* Added namespace for totals (https://github.com/givanz/Vvveb/commit/d2e7a00ea9661524291c8105e7a006b13ba69dfd)
* Added rounded integer rating (https://github.com/givanz/Vvveb/commit/6b790afe6a56cc5461f363272ef1e4a6d8d4bbba)
* Wildcard search if only search has only one word (https://github.com/givanz/Vvveb/commit/c411e339386a06ee94196a8178b77e69b33e1637)
* Edit order keep post values (https://github.com/givanz/Vvveb/commit/16d8f9340a3d8e026d251767fdb6c8e6e5d8fc99)
* Fixed missing type notice for filters (https://github.com/givanz/Vvveb/commit/31e2d42f02292a29f99c8ef03e2d1df6172e06a9)
* Fixed search order by score (https://github.com/givanz/Vvveb/commit/45dfefee51e3878c78d095d073247a31aa40f08b)
* Added categories for admin search (https://github.com/givanz/Vvveb/commit/7a4ad759087bf237ff5734a3b77537de2d68a489)
* Php 8.4 fix (https://github.com/givanz/Vvveb/commit/19b7bf580fe1d49a259e6a229303cf390ccb6894)
* Fix theme install, show themes list after theme install (https://github.com/givanz/Vvveb/commit/2ed4a56af38e92c5f93e40980ec02652223448bc)
* Fixed plugin slug issue (https://github.com/givanz/Vvveb/commit/8dd6c62d13c964a00e51a674a0d5ba923cd281b2)
* Allow php code editing only for admin and super admin roles (https://github.com/givanz/Vvveb/commit/cc8816b289379debb4ec01bc07445e235e092d91)
* Show not found if post id is missing for revisions page (https://github.com/givanz/Vvveb/commit/d04618315033027cfda7c7a86f6d7cbc7b5fb6ac)
* Menu items image support (https://github.com/givanz/Vvveb/commit/d4806ff912ece64095d4a77a55b21f250c6ef0f5)
* Site language homepage settings (https://github.com/givanz/Vvveb/commit/1b1d2aca4a71d4800ce7912f16c794988bd5ce94)
* Site specific routes support (https://github.com/givanz/Vvveb/commit/f2b65e0150f627abc4385d984dd2ee5cf3e3f2ea)
* Resize method for images (https://github.com/givanz/Vvveb/commit/582997719035e0d3d6818cd7c1b0b14b451e2504)
* Site path support for using multi site within subfolders in addition to subdomains (https://github.com/givanz/Vvveb/commit/51fc2ce4083f9007bfe6b89b1c0395b2c2475b68)
* Json decode parameter fix (https://github.com/givanz/Vvveb/commit/01419072980a1d609b0e2a7700d94ff79eabf471)
* Use id instead of slug if translation is missing (https://github.com/givanz/Vvveb/commit/21c7e9a1f1b9b6477a996bc82c0542b2c73d866d)
* Languages code refactor (https://github.com/givanz/Vvveb/commit/a7955a6e6a8c3188d5d7656fd27bc125a7397fab)
* Fixed vulnerability "Unauthenticated Remote Code Execution via PHP Code Injection into 'env.php' During Installation", reported by @sh4dowalker Mohammed EL OUARDANI (https://github.com/givanz/Vvveb/commit/5162c1639130bd080ab63c7d856788cd59d6b3b7) 
* Fixed rename failing to prevent rename to restricted file extension in media library, 'Remote Code Execution via Chained Rename Bypass and .htaccess PHP Handler Injection', reported by @sh4dowalker Mohammed EL OUARDANI  (https://github.com/givanz/Vvveb/commit/6fb8eaa998265e33e8802cbc220d8859dbc144f2)
* Deny phtml extension for media library upload, fix for 'Remote Code Execution via Unrestricted .phtml File Upload', reported by @sh4dowalker Mohammed EL OUARDANI https://github.com/givanz/Vvveb/issues/418 (https://github.com/givanz/Vvveb/commit/23ac0e8c758d80f3c4d9224763c8b2359648270e) 
* Deny html extension for media library upload, fix for 'Malicious File Upload Leading to RCE', vulnerability reported by @0xHamy Hamed Kohi of Delta Obscura (https://github.com/givanz/Vvveb/commit/cc997d3359ea5e49a45c132f5dee3bc80fb441d7)  
* Fix for Authenticated SSRF via 'oEmbedProxy', vulnerability reported by (https://github.com/givanz/Vvveb/commit/2d356844f37819bf771e7cd5e12a8686975e0b2b) @0xHamy Hamed Kohi of Delta Obscura (https://github.com/givanz/Vvveb/commit/2d356844f37819bf771e7cd5e12a8686975e0b2b)
* Fix for 'Privilege Escalation via 'role_id' Injection, vulnerability reported by  @0xHamy Hamed Kohi of Delta Obscura (https://github.com/givanz/Vvveb/commit/0eca14af50f038915b8bf7ceec2becf6b6720b0a)
* Removed default value from 'data' TEXT type column to avoid mysql error (https://github.com/givanz/Vvveb/commit/13c2142da2f3b86d5650c40766fc7fe8c604e981) https://github.com/givanz/Vvveb/issues/407
* Landing theme team demo images update (https://github.com/givanz/Vvveb/commit/e3beaf4cba6ec6e60fb8b504992952784f3ea15a)
* Themes udpate (https://github.com/givanz/Vvveb/commit/8f883aac467d4a685d2b472917033643ce36a3be)