Unrestricted File Upload Vulnerability in Vvveb by Givanz

CVE-2026-41938

What is CVE-2026-41938?

The Vvveb media upload handler prior to version 1.0.8.2 has a serious vulnerability allowing authenticated users with media-upload permissions to upload unauthorized files, including .htaccess files. This exploit permits the mapping of .phtml extensions to the PHP handler, enabling attackers to upload .phtml files containing malicious PHP code. Once these files are uploaded, an unauthenticated HTTP GET request can trigger their execution, potentially leading to remote code execution with the web server's privileges.

References