What’s Vulnerable › Vulnerabilities

CVE-2026-41934: Vvveb < 1.0.8.2 Authenticated RCE via Code Editor

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-06 · updated 2026-10-26
• Weakness: CWE-184

Description

Vvveb before version 1.0.8.2 contains an authenticated remote code execution vulnerability in the admin code editor that allows low-privilege authenticated users to execute arbitrary code through insufficient file extension restrictions, with the uploaded payload then executable via subsequent unauthenticated HTTP requests. Attackers with editor, author, contributor, or site_admin roles can write a malicious .htaccess file to map arbitrary extensions to the PHP handler, then upload PHP code with that extension to achieve unauthenticated remote code execution when the file is accessed via HTTP.

Affected products

• givanz Vvveb: before 1.0.8.2 — fixed in 1.0.8.2

How to fix

Upgrade to a fixed version: givanz Vvveb 1.0.8.2. Check the vendor advisory for mitigations.

References

• https://github.com/givanz/Vvveb/commit/1196561276a3f49da5a714fef89ac9a6c6f9e33b
• https://github.com/givanz/Vvveb/releases/tag/1.0.8.2
• https://github.com/givanz/Vvveb/security/advisories/GHSA-vfjj-gcvv-w248
• https://www.vulncheck.com/advisories/vvveb-authenticated-rce-via-code-editor

Get alerted when CVE-2026-41934 or the next vulnerability affects your stack