Vvveb CMS CVE-2026-41938

Requires authenticated access to Vvveb CMS with media-upload permissions (typically editor, author, or contributor roles - not necessarily full administrator). The target server must run Apache HTTP Server with AllowOverride directive enabled (AllowOverride All or AllowOverride FileInfo minimum) in the configuration affecting the media upload directory, allowing .htaccess files to modify server behavior. Default Vvveb installations on shared hosting or common LAMP stacks typically meet this requirement. Attack succeeds against default configurations of vulnerable Vvveb versions (pre-1.0.8.2) without requiring non-standard features or deployment modes. Exploitation is LIMITED by the need for valid low-privilege credentials - this is not remotely exploitable by unauthenticated attackers. nginx-based deployments are NOT vulnerable to the .htaccess component of the attack, though the underlying unrestricted upload issue may still pose risk if other execution vectors exist.

Real-world risk is HIGH for Vvveb installations with authenticated users. CVSS 4.0 score of 8.7 reflects severe impact (VC:H/VI:H/VA:H) with network attack vector (AV:N), low complexity (AC:L), and no user interaction required (UI:N). The PR:L (low privileges required) qualifier is critical - this is NOT an unauthenticated RCE; attackers must first obtain credentials for an account with media-upload permissions, typically editor or contributor roles in CMS environments. No EPSS score, KEV status, or public exploit code data provided in input, suggesting limited observed exploitation at time of analysis, though VulnCheck's dedicated advisory indicates researcher interest. The two-stage .htaccess bypass technique is well-documented in penetration testing literature, making weaponization straightforward for authenticated attackers. Primary risk scenario: compromised low-privilege accounts (via phishing, credential stuffing, or other vulnerabilities) escalating to full server compromise. Organizations must assess: (1) strength of authentication controls, (2) principle of least privilege for media upload permissions, and (3) AllowOverride configuration in Apache. Patch availability in version 1.0.8.2 with specific commit reference (54a9e846) provides clear remediation path. Risk is substantially lower for installations using nginx (no .htaccess support) or Apache with AllowOverride None, though input data does not confirm whether the patch also addresses upload validation - dependency on server configuration for defense is inherently fragile.

An attacker with compromised editor-level credentials (obtained via credential stuffing against weak passwords or phishing targeting content managers) logs into the Vvveb CMS admin panel. Using the media upload feature, they upload a malicious .htaccess file containing 'AddType application/x-httpd-php .phtml' to reconfigure Apache to treat .phtml files as executable PHP. They then upload a webshell named 'shell.phtml' containing <?php system($_REQUEST['cmd']); ?>. Without further authentication, they send HTTP GET requests to /media/uploads/shell.phtml?cmd=whoami (exact path depending on Vvveb configuration) to execute arbitrary operating system commands with web server user privileges, enabling data exfiltration, lateral movement, or persistent backdoor installation. The attack leaves minimal logs since .htaccess modification and .phtml uploads may appear as legitimate media management activity.