How to fix or mitigate CVE-2026-41938?

Within 24 hours: Audit current Vvveb CMS version across all instances and identify systems running versions prior to 1.0.8.2. Within 7 days: Apply vendor-released patch to Vvveb CMS 1.0.8.2 or later per GitHub security advisory GHSA-wwmv-4g9g-p48g (commit 54a9e846); restrict media-upload permissions to trusted administrative accounts only pending patch deployment. Within 30 days: Conduct comprehensive access review of all users with media-upload capabilities and implement principle-of-least-privilege controls for file upload functions.

Vvveb CMS CVE-2026-41938

Q: What is the CVSS score of CVE-2026-41938?

CVE-2026-41938 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

Q: Which versions of Vvveb CMS are affected by CVE-2026-41938?

Vvveb CMS versions before 1.0.8.2 contain a remote code execution vulnerability that allows authenticated users with media-upload permissions to execute arbitrary code on the web server.. A patch is available.

EUVD-2026-27893 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-05-06 VulnCheck

PHP RCE File Upload

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 06, 2026 - 19:46 vuln.today

Analysis Generated

May 06, 2026 - 19:46 vuln.today

CVSS changed

May 06, 2026 - 19:22 NVD

8.8 (HIGH) 8.7 (HIGH)

CVE Published

May 06, 2026 - 18:42 nvd

HIGH 8.7

DescriptionCVE.org

Vvveb before version 1.0.8.2 contains an unrestricted file upload vulnerability in the media upload handler that allows authenticated users with media-upload permissions to bypass extension restrictions by uploading a .htaccess file to map .phtml extensions to the PHP handler. Attackers can upload a .phtml file containing arbitrary PHP code and trigger execution by sending an unauthenticated HTTP GET request to the uploaded file, resulting in remote code execution with web server privileges.

AnalysisAI

Remote code execution in Vvveb CMS versions before 1.0.8.2 allows authenticated users with media-upload permissions to execute arbitrary PHP code with web server privileges via a two-stage attack: uploading a malicious .htaccess file to map .phtml extensions to the PHP handler, then uploading a .phtml file containing PHP code. Exploitation requires only low-privileged authentication (CVSS PR:L) and no user interaction (UI:N), making post-authentication compromise straightforward. Vendor-released patch available in version 1.0.8.2 per GitHub security advisory GHSA-wwmv-4g9g-p48g and commit 54a9e846. VulnCheck advisory provides detailed technical analysis of the bypass technique.

Technical ContextAI

This vulnerability exploits unrestricted file upload (CWE-434) combined with Apache .htaccess configuration override capabilities. Vvveb's media upload handler fails to prevent .htaccess file uploads, enabling attackers to reconfigure the web server's file type handling at runtime. By uploading a .htaccess file containing 'AddType application/x-httpd-php .phtml' (or similar directives), attackers map previously benign .phtml extensions to the PHP interpreter. Subsequent .phtml file uploads containing PHP code (e.g., <?php system($_GET['cmd']); ?>) are then executed by the server when accessed via HTTP GET requests. The affected product is identified as cpe:2.3:a:givanz:vvveb:*:*:*:*:*:*:*:* with versions prior to 1.0.8.2 vulnerable. This attack pattern is common in PHP-based CMSs running on Apache with AllowOverride enabled, where insufficient upload validation meets overly permissive .htaccess processing.

RemediationAI

Upgrade immediately to Vvveb version 1.0.8.2 or later, available from https://github.com/givanz/Vvveb/releases/tag/1.0.8.2. The security fix is implemented in commit 54a9e846fb94192f1b31ae81d81d25c874662e6a (https://github.com/givanz/Vvveb/commit/54a9e846fb94192f1b31ae81d81d25c874662e6a) - review commit diff to understand validation improvements. For environments unable to patch immediately, implement these compensating controls with noted trade-offs: (1) Configure Apache with 'AllowOverride None' in VirtualHost or Directory directives to prevent .htaccess processing - this breaks any legitimate .htaccess functionality Vvveb may rely on for URL rewriting or access control, requiring manual migration of those rules to httpd.conf. (2) Restrict media-upload permissions to only highly trusted administrator accounts and audit existing accounts with these permissions - reduces attack surface but impacts content workflow efficiency. (3) Implement file upload validation at the web server level using mod_security or similar WAF rules to block .htaccess uploads - adds operational complexity and may have performance impact. (4) If using nginx instead of Apache, .htaccess files are ignored by default, though underlying upload validation weakness remains. After patching, conduct forensic review of existing uploaded files in media directories for unexpected .htaccess or .phtml files as indicators of prior compromise.