CVE-2026-41934
Deferred Deferred - Pending Action
Authenticated Remote Code Execution in Vvveb CMS via .htaccess File Upload

Publication date: 2026-05-06

Last updated on: 2026-05-06

Assigner: VulnCheck

Description
Vvveb before version 1.0.8.2 contains an authenticated remote code execution vulnerability in the admin code editor that allows low-privilege authenticated users to execute arbitrary code by exploiting insufficient file extension restrictions. Attackers with editor, author, contributor, or site_admin roles can write a malicious .htaccess file to map arbitrary extensions to the PHP handler, then upload PHP code with that extension to achieve unauthenticated remote code execution when the file is accessed via HTTP.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-06
Last Modified
2026-05-06
Generated
2026-05-07
AI Q&A
2026-05-06
EPSS Evaluated
N/A
NVD
EUVD
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
vvveb vvveb to 1.0.8.2 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-184 The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability exists in Vvveb versions before 1.0.8.2 and involves an authenticated remote code execution flaw in the admin code editor.

Low-privilege authenticated users with roles such as editor, author, contributor, or site_admin can exploit insufficient file extension restrictions to execute arbitrary code.

They do this by writing a malicious .htaccess file that maps arbitrary file extensions to the PHP handler, then uploading PHP code with that extension.

When the uploaded file is accessed via HTTP, it results in unauthenticated remote code execution.


How can this vulnerability impact me? :

This vulnerability can allow attackers with low-level authenticated access to execute arbitrary code on the server remotely without further authentication.

Such unauthorized code execution can lead to full system compromise, data theft, service disruption, or further attacks within the affected environment.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart