CVE-2026-41934
HighSummary
Vvveb before version 1.0.8.2 contains an authenticated remote code execution vulnerability in the admin code editor that allows low-privilege authenticated users to execute arbitrary code through insufficient file extension restrictions.
Risk Assessment
Attackers with editor, author, contributor, or site_admin roles can write a malicious .htaccess file, leading to unauthenticated remote code execution when the file is accessed via HTTP.
Recommendation
It is recommended to update Vvveb to version 1.0.8.2 or later and to implement additional restrictions on allowed file extensions in the code editor.
Other vulnerabilities in Vvveb
See all- CVE-2026-41938High
Vvveb before version 1.0.8.2 contains an unrestricted file upload vulnerability in the media upload handler that allows authenticated users with media-upload permissions to bypass extension restrictions by uploading a .htaccess file. This enables attackers to upload .phtml files containing arbitrary PHP code and execute the payload through an unauthenticated HTTP GET request.
- CVE-2026-41936High
Vvveb before version 1.0.8.2 contains an XML external entity (XXE) injection vulnerability in the admin Tools/Import feature that allows authenticated site_admin users to read arbitrary files and modify database records.
- CVE-2026-41930Critical
Vvveb before version 1.0.8.2 contains a hard-coded credentials vulnerability in its docker-compose-apache.yaml configuration that allows unauthenticated attackers to access the bundled phpMyAdmin container with pre-configured database credentials.
- CVE-2026-39918Critical
Vvveb prior to version 1.0.8.1 contains a code injection vulnerability in the installation endpoint where the subdir POST parameter is written unsanitized into the env.php configuration file. Attackers can inject arbitrary PHP code by breaking out of the string context in the define statement, leading to unauthenticated remote code execution as the web server user.
- CVE-2026-49228High
Vvveb before version 1.0.8.4 allows a low-privileged Vendor to access products owned by another Vendor. The product controller does not verify ownership for duplicate and delete actions, enabling reading, duplicating, and deleting products and related data.
- CVE-2026-49225High
Vvveb before version 1.0.8.4 allows a low-privileged Vendor to access revisions for products owned by another Vendor. SQL queries do not verify product ownership for revision reads, restores, and deletes.
- CVE-2026-49224High
Vvveb before version 1.0.8.4 allows a low-privileged Author to access revisions for posts owned by another Author. SQL queries do not verify post ownership for revision lists, reads, restores, and deletes.
- CVE-2026-49223High
Vvveb before version 1.0.8.4 allows a low-privileged Vendor to manage reviews under another Vendor's products. SQL queries do not verify product ownership for reviews.
- CVE-2026-49222High
Vvveb before version 1.0.8.4 allows a low-privileged Vendor to manage questions under another Vendor's products. SQL queries do not verify product ownership for questions.
- CVE-2026-49227High
Vvveb before version 1.0.8.4 has a vulnerability in backend comment operations that allows a low-privileged Author to manage comments under another Author's posts. Lack of ownership verification enables reading comment content, email addresses, changing moderation status, editing or deleting comments.
Original NVD description (English source)
Vvveb before version 1.0.8.2 contains an authenticated remote code execution vulnerability in the admin code editor that allows low-privilege authenticated users to execute arbitrary code through insufficient file extension restrictions, with the uploaded payload then executable via subsequent unauthenticated HTTP requests. Attackers with editor, author, contributor, or site_admin roles can write a malicious .htaccess file to map arbitrary extensions to the PHP handler, then upload PHP code with that extension to achieve unauthenticated remote code execution when the file is accessed via HTTP.