CVE-2026-41934 - Vulnerability Analysis

Overview

Vvveb before version 1.0.8.2 contains an authenticated remote code execution caused by insufficient file extension restrictions in the admin code editor, letting low-privilege authenticated users execute arbitrary code remotely, exploit requires authenticated user with editor or higher roles.

Severity & Score

Impact

Low-privilege authenticated users can execute arbitrary code remotely, potentially leading to full server compromise.

Mitigation

Update to version 1.0.8.2 or later.

References

• https://www.vulncheck.com/advisories/vvveb-authenticated-rce-via-code-editor
• https://github.com/givanz/Vvveb/commit/1196561276a3f49da5a714fef89ac9a6c6f9e33b
• https://github.com/givanz/Vvveb/releases/tag/1.0.8.2
• https://github.com/givanz/Vvveb/security/advisories/GHSA-vfjj-gcvv-w248

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner