Unrestricted File Upload Vulnerability in Vvveb Plugin by Givanz

CVE-2026-41937

What is CVE-2026-41937?

The Vvveb plugin prior to version 1.0.8.3 contains an unrestricted file upload vulnerability within the plugin's upload endpoint. This flaw allows super_admin users to upload malicious plugin ZIP files, potentially executing arbitrary PHP code. Attackers can exploit this by crafting a ZIP file containing a plugin.php with a valid Slug header alongside a public/index.php file that embeds arbitrary PHP code, which will run on the server when accessed through unauthenticated HTTP requests to the public path of the plugin.

References