CVE-2026-126372
Deferred Deferred - Pending Action

Authenticated Template File Upload RCE in Vvveb

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
Vvveb through 1.0.8.6 contains an incomplete fix for CVE-2026-41934 that allows authenticated editor or site_admin users to write server-side templates by bypassing save restrictions. Attackers can upload or rename .tpl files via editor/code upload and rename actions, or evade isExecutableFile checks in save(), to inject PHP code into templates.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126372
EUVD
EUVD-2026-125193

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
givanz Vvveb From 0 (inc) to 1.0.8.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-126372 is a high-severity vulnerability in Vvveb versions up to 1.0.8.6. It allows authenticated users with editor or site_admin privileges to bypass restrictions and upload or rename .tpl files via editor/code functionality. This enables PHP code injection into server-side templates by evading file execution checks.

Detection Guidance

Check for unauthorized .tpl files in Vvveb directories, particularly in editor/code upload or rename actions. Inspect MediaTrait class for missing 'tpl' in uploadDenyExtensions. Review server-side templates for unexpected PHP code injection.

Impact Analysis

Attackers could exploit this to execute arbitrary PHP code on the server, potentially leading to full system compromise, data theft, or unauthorized access. The impact depends on the privileges of the compromised account and the server configuration.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements or HIPAA's security rules. Organizations using affected Vvveb versions may face compliance violations and potential penalties.

Mitigation Strategies
  • Add 'tpl' to MediaTrait::$uploadDenyExtensions to block .tpl file uploads.
  • Enforce role checks for upload, rename, and delete actions in themes/plugins.
  • Validate entire file content for PHP tags before saving, not just first 16 bytes.
  • Upgrade Vvveb to a patched version if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126372. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...