Which versions of Vvveb CMS are affected by CVE-2026-41936?

Vvveb CMS versions before 1.0.8.2 contain an XML external entity injection vulnerability in the admin import feature that allows authenticated administrators to read sensitive server files and modify…. A patch is available.

How to fix or mitigate CVE-2026-41936?

Within 24 hours: Inventory all Vvveb CMS installations and identify those running versions prior to 1.0.8.2. Within 7 days: Upgrade all affected instances to Vvveb CMS 1.0.8.2 or later. Within 30 days: Audit admin account activity logs for suspicious import operations and review administrator password change history to detect unauthorized modifications.

Vvveb CMS CVE-2026-41936

Q: What is the CVSS score of CVE-2026-41936?

CVE-2026-41936 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-27892 HIGH

Improper Restriction of XML External Entity Reference (CWE-611)

2026-05-06 VulnCheck

XXE Privilege Escalation PHP

8.6

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 06, 2026 - 19:45 vuln.today

Analysis Generated

May 06, 2026 - 19:45 vuln.today

CVSS changed

May 06, 2026 - 19:22 NVD

8.1 (HIGH) 8.6 (HIGH)

CVE Published

May 06, 2026 - 18:27 nvd

HIGH 8.6

DescriptionCVE.org

Vvveb before version 1.0.8.2 contains an XML external entity (XXE) injection vulnerability in the admin Tools/Import feature that allows authenticated site_admin users to read arbitrary files and modify database records. Attackers can exploit the XML parser configuration in system/import/xml.php to inject file:// or php://filter entity references that are resolved and persisted into the application database, enabling arbitrary file disclosure and administrator password hash overwriting for privilege escalation.

AnalysisAI

XML external entity injection in Vvveb CMS versions before 1.0.8.2 allows authenticated site_admin users to read arbitrary server files and overwrite administrator password hashes via the admin Tools/Import feature. The vulnerability resides in system/import/xml.php where LIBXML_NOENT flag enabled external entity resolution, allowing injection of file:// and php://filter protocols. Attackers with low-privilege admin accounts can escalate to full administrator access by replacing password hashes in the database. Vendor-released patch version 1.0.8.2 removes LIBXML_NOENT flag. No active exploitation confirmed by CISA KEV at time of analysis.

Technical ContextAI

The vulnerability stems from unsafe XML parsing configuration in PHP's libxml library. The affected code in system/import/xml.php configured the XML parser with LIBXML_NOENT flag, which instructs libxml to expand external entity references defined in DOCTYPE declarations. XXE (CWE-611) is a classic injection attack where malicious XML documents containing <!DOCTYPE> declarations with <!ENTITY> references to file:// or php://filter URIs cause the parser to resolve and embed external content. In Vvveb's case, the parsed XML content is then persisted into the database, creating a write-what-where condition. The php://filter wrapper enables Base64-encoding of arbitrary files for exfiltration even when raw file content would break XML parsing. The vulnerability is compounded by the import feature's database write functionality, allowing attackers to target specific database fields like user password hashes for privilege escalation beyond simple file disclosure.

RemediationAI

Upgrade to Vvveb CMS version 1.0.8.2 or later, available at https://github.com/givanz/Vvveb/releases/tag/1.0.8.2. The fix (commit 098fc428586f20ee02981af976512fb62bc25b8a) removes the LIBXML_NOENT flag from XML parser configuration, preventing external entity resolution. If immediate patching is not feasible, implement these compensating controls: (1) Disable or restrict access to the admin Tools/Import feature at the web server level by blocking requests to /admin/tools/import paths - this prevents exploitation but breaks legitimate import functionality. (2) Implement strict input validation to reject XML documents containing DOCTYPE declarations before parsing - use regular expressions to detect <!DOCTYPE and <!ENTITY patterns and reject such uploads, though sophisticated attackers may bypass pattern matching. (3) Enforce principle of least privilege by auditing site_admin role assignments and removing unnecessary accounts - this reduces the attack surface but does not eliminate risk from compromised legitimate accounts. (4) Deploy file integrity monitoring on the user credentials database table to detect unauthorized password hash modifications - provides detection but not prevention. All workarounds have operational impact on normal admin workflows and should be considered temporary measures pending full patch deployment.