CVE-2026-6257 Details
Description
Vvveb CMS v1.0.8.2 contains a remote code execution vulnerability in its media management functionality where a missing return statement in the file rename handler allows authenticated attackers to rename files to blocked extensions .php or .htaccess. Attackers can exploit this logic flaw by first uploading a text file and renaming it to .htaccess to inject Apache directives that register PHP-executable MIME types, then uploading another file and renaming it to .php to execute arbitrary operating system commands as the www-data user.
A remote code execution vulnerability has been identified in Vvveb CMS version 1.0.8, specifically within the media management feature. The issue arises from a logic flaw in the file rename handler, where a missing return statement allows authenticated attackers to rename files with restricted extensions, such as .php or .htaccess. Exploitation involves uploading a text file, renaming it to .htaccess to inject Apache directives that enable PHP-executable MIME types, and then uploading another file, renaming it to .php, to execute arbitrary operating system commands as the www-data user.
Users can update to Vvveb CMS version 1.0.8.1, which addresses this vulnerability by preventing renaming files to restricted extensions.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 20, 2026CISA-ADP
Assessed Apr 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/givanz/Vvveb/commit/6fb8eaa998265e33e8802cbc220d8859dbc144f2 | [email protected] | Source CodeVendor |
| https://www.vulncheck.com/advisories/vvveb-cms-remote-code-execution-via-media-management | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-434 | Unrestricted Upload of File with Dangerous Type | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Vvveb CMS | All versions |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 26, 2026 | CVE Modified | [email protected] |
| May 6, 2026 | CVE Modified | [email protected] |
| Apr 20, 2026 | New CVE Received | [email protected] |