CVE-2026-41937: Vvveb < 1.0.8.3 Unrestricted File Upload RCE via Plugin Upload

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-14 · updated 2026-10-26
Weakness: CWE-61

Description

Vvveb before 1.0.8.3 contains an unrestricted file upload vulnerability in the plugin upload endpoint that allows super_admin users to execute arbitrary PHP code by uploading a malicious plugin ZIP file. Attackers can craft a ZIP containing a plugin.php with a valid Slug header and a public/index.php file with arbitrary PHP code, which executes as the web server user once accessed via subsequent unauthenticated HTTP requests to the plugin's public path.

Affected products

givanz Vvveb: before 1.0.8.3 — fixed in 1.0.8.3

How to fix

Upgrade to a fixed version: givanz Vvveb 1.0.8.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-41937 or the next vulnerability affects your stack