Authenticated Remote Code Execution in Vvveb by Givanz

CVE-2026-41934

What is CVE-2026-41934?

Vvveb versions prior to 1.0.8.2 are susceptible to an authenticated remote code execution vulnerability due to inadequate restrictions on file extensions. Low-privilege authenticated users, such as editors or contributors, can exploit this flaw through the admin code editor by creating malicious .htaccess files. These files can associate arbitrary file extensions with the PHP handler, enabling these users to upload PHP scripts disguised with non-standard extensions. If accessed, these scripts can lead to unauthorized remote code execution, thus compromising the security of the web application.

References