CVE-2026-6257: Vvveb CMS < v1.0.8.2 Remote Code Execution via Media Management

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-20 · updated 2026-10-29
Weakness: CWE-434

Description

Vvveb CMS before 1.0.8.2 contains a remote code execution vulnerability in its media management functionality where a missing return statement in the file rename handler allows authenticated attackers to rename files to blocked extensions .php or .htaccess. Attackers can exploit this logic flaw by first uploading a text file and renaming it to .htaccess to inject Apache directives that register PHP-executable MIME types, then uploading another file and renaming it to .php to execute arbitrary operating system commands as the www-data user.

Affected products

Vvveb CMS: before 1.0.8.2 — fixed in 1.0.8.2

How to fix

Upgrade to a fixed version: Vvveb CMS 1.0.8.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-6257 or the next vulnerability affects your stack