CVE-2026-41937CWE-434CWE-61

Vvveb < 1.0.8.3 Unrestricted File Upload RCE via Plugin Upload

High · published May 14, 2026

CVSS v4.0
8.6
EPSS
1%
Percentile
49.5
In the wild
Unconfirmed
What it is

Vvveb before 1.0.8.3 contains an unrestricted file upload vulnerability in the plugin upload endpoint that allows super_admin users to execute arbitrary PHP code by uploading a malicious plugin ZIP file. Attackers can craft a ZIP containing a plugin.php with a valid Slug header and a public/index.php file with arbitrary PHP code, which executes as the web server user once accessed via subsequent unauthenticated HTTP requests to the plugin's public path.

The record
Technical detail
CVSS v4.0
8.6 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00628 · 49.5th percentile
Weaknesses
CWE-434 · Unrestricted Upload of File with Dangerous Type; CWE-61 · UNIX Symbolic Link (Symlink) Following
Published
2026-05-14T14:30Z
EPSS history
Timeline
  • 14 MAY 14:30Z
    Vvveb < 1.0.8.3 Unrestricted File Upload RCE via Plugin Upload
    cvelistv5