CVE-2026-41938CWE-434

Vvveb < 1.0.8.2 RCE via Media Upload Handler

High · published May 6, 2026

CVSS v4.0
8.7
EPSS
1%
Percentile
62.4
In the wild
Unconfirmed
What it is

Vvveb before version 1.0.8.2 contains an unrestricted file upload vulnerability in the media upload handler that allows authenticated users with media-upload permissions to bypass extension restrictions by uploading a .htaccess file to map .phtml extensions to the PHP handler. Attackers can upload a .phtml file containing arbitrary PHP code and execute the uploaded payload through a subsequent unauthenticated HTTP GET request to the uploaded file, resulting in remote code execution with web server privileges.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00999 · 62.4th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-05-06T18:42Z
EPSS history
Timeline
  • 06 MAY 18:42Z
    Vvveb < 1.0.8.2 RCE via Media Upload Handler
    cvelistv5