CVE-2026-6249 Details

A remote code execution vulnerability has been identified in Vvveb CMS version 1.0.8. This issue arises in the media upload handler, where authenticated attackers can upload PHP web shells with a .phtml extension, bypassing the extension deny-list. The uploaded files are placed in a publicly accessible media directory. Once the malicious file is uploaded, it can be accessed over HTTP, allowing the attacker to execute arbitrary operating system commands and potentially compromise the entire server.

Users can update to Vvveb CMS version 1.0.8.1, which addresses this vulnerability by adding .phtml to the extension deny-list for media uploads.