Starstruk Logo MarkStarstruk

1.0.8.6

givanz/Vvveb1.0.8.6Jun 11, 2026by givanz

AI Summary

This release focuses heavily on security hardening, addressing vulnerabilities reported by @EvidentObscurity regarding private IP redirects, IPv6 bypass, and HTML sanitization issues. It also includes updates to the admin template and page builder UI.

Key Highlights

  • Fixed sanitizeHTML for 'on' attributes when attribute contains '>', and added recursive filtering for sanitizeFileName.
  • Updated admin template and page builder UI changes.
  • Fixed tree list expand arrow button click and translations edit error messages.

New Features

  • Recursive filtering sanitizeFileName
  • Enhanced sanitizeHTML for attribute sanitization

Full Release Notes

* Use curl resolve to avoid private ip redirect and IPv6 bypass, vulnerability reported by @EvidentObscurity https://github.com/givanz/Vvveb/commit/e27d1ef097a8502c33f8cc94271c948407c5dce3
* Admin template update, page builder UI changes https://github.com/givanz/Vvveb/commit/a4882d42411466ea90b6612933b5d1f70fa7cc83
* Plugins update https://github.com/givanz/Vvveb/commit/513db6d716410d75bed99436bf5ed10384cca100
* Translations edit show server message on error, fixed tree list expand arrow button click https://github.com/givanz/Vvveb/commit/6bc8390957256dd831691f352e8c472fb3c91374
* Fixed sanitizeHTML( 'on' attributes sanitization when attribute has '>', vulnerability reported by @EvidentObscurity https://github.com/givanz/Vvveb/commit/c466e618ad1b94916f56062b7732edb5a336f57d
* Added recursive filtering sanitizeFileName(, vulnerability reported by @EvidentObscurity https://github.com/givanz/Vvveb/commit/8c062a047a66d6f04307f8d0e37c34f709a201a9