CVE-2026-41938 - Vulnerability Analysis

Overview

Vvveb before version 1.0.8.2 contains an unrestricted file upload vulnerability caused by improper validation in the media upload handler, letting authenticated users with media-upload permissions upload malicious .htaccess and .phtml files to execute arbitrary PHP code remotely.

Severity & Score

Impact

Attackers can execute arbitrary PHP code remotely with web server privileges, leading to full server compromise.

Mitigation

Update to version 1.0.8.2 or later.

References

• https://www.vulncheck.com/advisories/vvveb-rce-via-media-upload-handler
• https://github.com/givanz/Vvveb/commit/54a9e846fb94192f1b31ae81d81d25c874662e6a
• https://github.com/givanz/Vvveb/releases/tag/1.0.8.2
• https://github.com/givanz/Vvveb/security/advisories/GHSA-wwmv-4g9g-p48g

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner