CVE-2026-41938 Details
Description
Vvveb before version 1.0.8.2 contains an unrestricted file upload vulnerability in the media upload handler that allows authenticated users with media-upload permissions to bypass extension restrictions by uploading a .htaccess file to map .phtml extensions to the PHP handler. Attackers can upload a .phtml file containing arbitrary PHP code and execute the uploaded payload through a subsequent unauthenticated HTTP GET request to the uploaded file, resulting in remote code execution with web server privileges.
A remote code execution vulnerability has been identified in Vvveb versions prior to 1.0.8.2. This issue arises from an unrestricted file upload feature in the media upload handler, which allows authenticated users with media-upload permissions to bypass extension restrictions. By uploading a .htaccess file to map .phtml extensions to the PHP handler, attackers can execute arbitrary PHP code. The vulnerability is exploited by sending an unauthenticated HTTP GET request to the uploaded .phtml file, leading to remote code execution with web server privileges.
Users are advised to update to Vvveb version 1.0.8.2 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 6, 2026CISA-ADP
Assessed May 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/givanz/Vvveb/security/advisories/GHSA-wwmv-4g9g-p48g | CISA-ADP | AdvisoryExploitRemedy |
| https://github.com/givanz/Vvveb/commit/54a9e846fb94192f1b31ae81d81d25c874662e6a | [email protected] | Source CodeVendor |
| https://github.com/givanz/Vvveb/releases/tag/1.0.8.2 | [email protected] | Release NotesVendor |
| https://github.com/givanz/Vvveb/security/advisories/GHSA-wwmv-4g9g-p48g | [email protected] | AdvisoryExploitRemedy |
| https://www.vulncheck.com/advisories/vvveb-rce-via-media-upload-handler | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-434 | Unrestricted Upload of File with Dangerous Type | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Vvveb | All versions |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 26, 2026 | CVE Modified | [email protected] |
| May 6, 2026 | CVE Modified | CISA-ADP |
| May 6, 2026 | New CVE Received | [email protected] |