How to fix or mitigate CVE-2026-41937?

Within 24 hours: Identify all Vvveb CMS instances in your environment and document current versions; restrict super_admin plugin upload functionality through web application firewall rules or access controls. Within 7 days: Contact Vvveb vendor for patch timeline and interim security guidance; implement file integrity monitoring on plugin directories; review admin account access logs for suspicious plugin uploads. Within 30 days: Update all Vvveb CMS instances to version 1.0.8.3 or later once vendor releases patch; conduct forensic review of plugin directory for unauthorized uploads; audit super_admin account permissions.

Vvveb CMS CVE-2026-41937

Q: What is the CVSS score of CVE-2026-41937?

CVE-2026-41937 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

Q: Which versions of Vvveb CMS are affected by CVE-2026-41937?

Vvveb CMS before version 1.0.8.3 contains a remote code execution vulnerability that allows authenticated super_admin users to upload malicious plugins and execute arbitrary code at the web server…. A patch is available.

EUVD-2026-30297 HIGH

UNIX Symbolic Link (Symlink) Following (CWE-61)

2026-05-14 disclosure@vulncheck.com

GHSA-gv85-3994-qprw

PHP File Upload

8.6

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (vulncheck) · only source for this CVE.

CVSS VectorVendor: vulncheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Patch available

May 14, 2026 - 16:01 EUVD

Source Code Evidence Fetched

May 14, 2026 - 15:32 vuln.today

Analysis Generated

May 14, 2026 - 15:32 vuln.today

CVE Published

May 14, 2026 - 15:16 nvd

HIGH 8.6

DescriptionCVE.org

Vvveb before 1.0.8.3 contains an unrestricted file upload vulnerability in the plugin upload endpoint that allows super_admin users to execute arbitrary PHP code by uploading a malicious plugin ZIP file. Attackers can craft a ZIP containing a plugin.php with a valid Slug header and a public/index.php file with arbitrary PHP code, which executes as the web server user when accessed via unauthenticated HTTP requests to the plugin's public path.

AnalysisAI

Remote code execution in Vvveb CMS before 1.0.8.3 allows authenticated super_admin users to upload malicious plugin ZIP files containing arbitrary PHP code. Once uploaded, the code executes with web server privileges via unauthenticated HTTP requests to the plugin's public directory, enabling privilege escalation from authenticated admin to system-level code execution. CVSS 8.6 (High) with network attack vector but requires high privileges (PR:H). No active exploitation confirmed at time of analysis, but attack chain is straightforward with publicly documented technique.

Technical ContextAI

Vvveb is a PHP-based open-source CMS. The vulnerability exists in the plugin upload mechanism (admin/controller/plugin/plugins.php) prior to version 1.0.8.3. The system fails to validate or sanitize plugin ZIP archives before extracting them to the web-accessible plugins directory. Attackers exploit this by crafting a ZIP with a valid plugin.php (containing required metadata like Slug header) and embedding malicious PHP code in public/index.php. CWE-61 (UNIX Symbolic Link Following) classification appears incorrect based on the description - this is more accurately CWE-434 (Unrestricted Upload of File with Dangerous Type) or CWE-94 (Improper Control of Generation of Code). The two-stage attack (authenticated upload + unauthenticated execution) creates a privilege boundary violation, as the initial PR:H requirement is bypassed after upload when accessing the public path without authentication.

RemediationAI

Upgrade immediately to Vvveb 1.0.8.3 or later per GitHub release at https://github.com/givanz/Vvveb/releases/tag/1.0.8.3. The fix commit (04f0294350ec429e307cd31c2e777a4797c868d6) modifies admin/controller/plugin/plugins.php to implement validation during plugin upload and activation. Review the commit diff at https://github.com/givanz/Vvveb/commit/04f0294350ec429e307cd31c2e777a4797c868d6 for technical details. If immediate patching is not feasible, implement compensating controls: (1) Restrict super_admin role to only essential personnel and enforce MFA on those accounts (reduces attack surface but does not eliminate vulnerability). (2) Use web application firewall rules to block ZIP uploads to /admin/controller/plugin/plugins.php endpoint (may break legitimate plugin installation workflows). (3) Monitor and audit the plugins directory for unauthorized files, specifically public/index.php files not matching known-good plugin hashes (detective control only, does not prevent exploitation). (4) Run Vvveb with least-privilege web server user in a containerized or jailed environment to limit post-exploitation impact (reduces blast radius but does not prevent RCE). All workarounds are partial mitigations; patching is the only complete fix. After patching, audit existing plugins for malicious files uploaded prior to upgrade.