CVE-2026-41936 Details

A XML External Entity (XXE) injection vulnerability has been identified in Vvveb versions prior to 1.0.8.2. The issue resides in the admin Tools/Import feature, where authenticated site_admin users can exploit the XML parser configuration to read arbitrary files and modify database records. The vulnerability arises because the XML parser is enabled to resolve external entity references, allowing attackers to inject file:// or php://filter entity references that are processed and saved into the application database. This exploitation can lead to unauthorized access to sensitive files and the ability to overwrite administrator password hashes, facilitating privilege escalation.

Users can update to Vvveb version 1.0.8.2 or later, where this vulnerability has been patched.