CVE-2026-41938
Vvveb Unrestricted File Upload RCE Vulnerability
Publication date: 2026-05-06
Last updated on: 2026-05-06
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| vvveb | vvveb | to 1.0.8.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Vvveb versions before 1.0.8.2 and involves an unrestricted file upload issue in the media upload handler.
Authenticated users with media-upload permissions can bypass file extension restrictions by uploading a .htaccess file that maps .phtml extensions to the PHP handler.
Attackers can then upload a .phtml file containing arbitrary PHP code and execute it remotely by sending an unauthenticated HTTP GET request to the uploaded file.
This results in remote code execution with the privileges of the web server.
How can this vulnerability impact me? :
The vulnerability allows attackers to execute arbitrary PHP code on the web server remotely.
This can lead to full compromise of the web server, including unauthorized access, data theft, data modification, or disruption of services.
Since the code execution occurs with web server privileges, attackers may be able to escalate their access or move laterally within the affected environment.