EUVD-2026-27889Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Vvveb before version 1.0.8.2 contains an authenticated remote code execution vulnerability in the admin code editor that allows low-privilege authenticated users to execute arbitrary code by exploiting insufficient file extension restrictions. Attackers with editor, author, contributor, or site_admin roles can write a malicious .htaccess file to map arbitrary extensions to the PHP handler, then upload PHP code with that extension to achieve unauthenticated remote code execution when the file is accessed via HTTP.
AnalysisAI
Remote code execution in Vvveb CMS versions before 1.0.8.2 enables low-privilege authenticated users (editor, author, contributor, or site_admin roles) to escalate privileges and execute arbitrary PHP code. Attackers exploit the admin code editor's insufficient file extension validation by first uploading a malicious .htaccess file that maps arbitrary extensions to the PHP handler, then uploading PHP code disguised with that extension. Once uploaded, the PHP code executes with web server privileges when accessed via HTTP, effectively bypassing authentication and achieving full system compromise. The vulnerability requires only low-privilege access (PR:L) with no attack complexity or user interaction (AC:L/UI:N), and vendor-released patch version 1.0.8.2 is confirmed available via GitHub. No public exploit code or active exploitation (KEV) confirmed at time of analysis.
Technical ContextAI
Vvveb is a PHP-based open-source content management system and website builder. This vulnerability stems from CWE-184 (Incomplete List of Disallowed Inputs) in the admin code editor component. The affected CPE is cpe:2.3:a:givanz:vvveb:*:*:*:*:*:*:*:* for versions prior to 1.0.8.2. The flaw exists because the code editor validates file extensions against a blocklist when users upload or edit files, but fails to prevent uploading .htaccess files - Apache HTTP Server configuration files that can override MIME type handlers. By uploading a .htaccess with directives like 'AddHandler application/x-httpd-php .xyz', attackers instruct Apache to interpret files with arbitrary extensions (.xyz) as executable PHP. The attacker then uploads malicious PHP code with the mapped extension, bypassing extension-based security controls. When the disguised PHP file is accessed via HTTP request, Apache executes it server-side, granting the attacker code execution in the context of the web server process. This two-stage attack (configuration file manipulation followed by code upload) is a classic .htaccess poisoning technique in PHP applications with insufficient upload validation.
RemediationAI
Upgrade to Vvveb CMS version 1.0.8.2 or later immediately, available from https://github.com/givanz/Vvveb/releases/tag/1.0.8.2. The security fix is implemented in commit 1196561276a3f49da5a714fef89ac9a6c6f9e33b (https://github.com/givanz/Vvveb/commit/1196561276a3f49da5a714fef89ac9a6c6f9e33b), which strengthens file extension validation in the admin code editor to prevent .htaccess uploads and restrict file types that can be edited or uploaded by non-administrator roles. If immediate patching is not feasible, implement these compensating controls with noted trade-offs: (1) Disable Apache .htaccess processing by setting 'AllowOverride None' in the Apache configuration for the Vvveb document root - this prevents .htaccess exploitation but may break Vvveb's URL rewriting and other .htaccess-dependent features, requiring manual configuration in Apache virtualhost directives. (2) Restrict admin code editor access to only fully-trusted administrator accounts by removing editor, author, contributor, and site_admin role permissions to the code editor feature via Vvveb role management - this limits attack surface but reduces content workflow flexibility. (3) Implement web application firewall (WAF) rules to block uploads of files named .htaccess or containing Apache handler directives (AddHandler, AddType patterns) - effectiveness depends on WAF placement and may be bypassed by encoding or naming variations. (4) Monitor and alert on .htaccess file creation in web-accessible directories using file integrity monitoring (FIM) tools - provides detection but not prevention. All compensating controls should be temporary measures pending upgrade to patched version. Consult GitHub security advisory GHSA-vfjj-gcvv-w248 and VulnCheck advisory at https://www.vulncheck.com/advisories/vvveb-authenticated-rce-via-code-editor for additional implementation guidance.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-184 – Incomplete List of Disallowed Inputs
View allShare
External POC / Exploit Code
Leaving vuln.today