Vvveb CVE-2026-6249

Requires authenticated access to Vvveb CMS with sufficient privileges to access the media upload functionality (PR:L indicates low-privilege user accounts suffice-standard content editor or contributor roles typically have upload permissions, not just administrators). The web server must be configured to execute .phtml files as PHP code, which is the default behavior in standard Apache with mod_php or PHP-FPM configurations and many Nginx PHP setups. Exploitation is NOT limited to administrative accounts or special configurations. The only meaningful barrier is obtaining valid authenticated credentials to any user account with media upload permissions, which are often granted broadly in CMS environments for content management workflows.

Real-world risk is HIGH for internet-facing Vvveb CMS installations with authenticated users. The CVSS 4.0 score of 8.7 accurately reflects severity: network-accessible (AV:N), low attack complexity (AC:L), requires only low-privilege authentication (PR:L), and delivers complete system compromise (VC:H/VI:H/VA:H). The PR:L requirement means any authenticated user account-including low-privilege content editors or contributors-can exploit this, not just administrators. No EPSS score available, but the vulnerability class (authenticated RCE via file upload) is well-understood and frequently targeted. Not currently in CISA KEV, suggesting no confirmed widespread exploitation, though VulnCheck's public advisory and the available GitHub patch commit increase attacker awareness. Attack complexity is genuinely low: authentication is the only barrier, and the .phtml bypass is trivial to execute. This is a legitimate critical priority for any organization running Vvveb CMS with multiple user accounts or untrusted authenticated users. The confined scope (SC:N/SI:N/SA:N) limits impact to the vulnerable CMS server itself, preventing lateral movement through the vulnerability alone, but full server compromise enables subsequent pivoting through other means.

An attacker with a low-privilege authenticated account (such as a content editor role) logs into the Vvveb CMS administrative interface. They navigate to the media upload functionality and craft a PHP webshell saved with a .phtml extension (e.g., shell.phtml containing system command execution code). The upload succeeds because the deny-list only blocks .php files. The attacker identifies the predictable public URL path to the uploaded file (typically /media/uploads/shell.phtml) and makes an HTTP GET request to that URL. The web server executes the .phtml file as PHP code, granting the attacker arbitrary command execution with the web server's privileges, enabling data exfiltration, malware installation, or complete server takeover.