CVE-2026-41937

Summary

Vvveb before 1.0.8.3 contains an unrestricted file upload vulnerability in the plugin upload endpoint that allows super_admin users to execute arbitrary PHP code by uploading a malicious plugin ZIP file. Attackers can craft a ZIP containing a plugin.php with a valid Slug header and a public/index.php file with arbitrary PHP code, which executes as the web server user once accessed via subsequent unauthenticated HTTP requests to the plugin's public path.

Affected Software

VendorProductVersion RangeStatus
givanzVvveb0 < 1.0.8.3affected
givanzVvveb04f0294350ec429e307cd31c2e777a4797c868d6unaffected

Weaknesses

  • CWE-434: Unrestricted Upload of File with Dangerous Type
  • CWE-61: UNIX Symbolic Link (Symlink) Following

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References