CVE-2026-41938 — Vvveb < 1.0.8.2 RCE via Media Upload Handler
Vvveb before version 1.0.8.2 contains an unrestricted file upload vulnerability in the media upload handler that allows authenticated users with media-upload permissions to bypa…
Published: 2026-05-06 · CVSS: 8.7 · CVSS 4.0
Vvveb before version 1.0.8.2 contains an unrestricted file upload vulnerability in the media upload handler that allows authenticated users with media-upload permissions to bypass extension restrictions by uploading a .htaccess file to map .phtml extensions to the PHP handler. Attackers can upload a .phtml file containing arbitrary PHP code and execute the uploaded payload through a subsequent unauthenticated HTTP GET request to the uploaded file, resulting in remote code execution with web server privileges.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7