Which versions of PHP are affected by CVE-2026-6249?

Vvveb CMS 1.0.8 contains a critical remote code execution vulnerability that allows authenticated users with low-level permissions to upload malicious files and execute arbitrary code on the server.. A patch is available.

How to fix or mitigate CVE-2026-6249?

Within 24 hours: Identify all systems running Vvveb CMS 1.0.8 and restrict access to upload functionality; document current version inventory. Within 7 days: Apply vendor-released patch to upgrade from version 1.0.8 to patched version via GitHub upstream repository. Within 30 days: Conduct file system audit for any suspicious .phtml or unusual PHP files in web-accessible directories; review access logs for unauthorized upload activity since last security scan.

PHP CVE-2026-6249

Q: What is the CVSS score of CVE-2026-6249?

CVE-2026-6249 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-23948 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-04-20 VulnCheck

PHP File Upload RCE

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 21, 2026 - 16:22 vuln.today

cvss_changed

Analysis Generated

Apr 20, 2026 - 20:34 vuln.today

CVSS changed

Apr 20, 2026 - 20:22 NVD

8.8 (HIGH) 8.7 (HIGH)

EUVD ID Assigned

Apr 20, 2026 - 20:00 euvd

EUVD-2026-23948

Analysis Generated

Apr 20, 2026 - 20:00 vuln.today

Patch released

Apr 20, 2026 - 20:00 nvd

Patch available

CVE Published

Apr 20, 2026 - 19:57 nvd

HIGH 8.7

DescriptionCVE.org

Vvveb CMS 1.0.8 contains a remote code execution vulnerability in its media upload handler that allows authenticated attackers to execute arbitrary operating system commands by uploading a PHP webshell with a .phtml extension. Attackers can bypass the extension deny-list and upload malicious files to the publicly accessible media directory, then request the file over HTTP to achieve full server compromise.

AnalysisAI

Remote code execution in Vvveb CMS 1.0.8 allows authenticated attackers with low privileges to upload PHP webshells disguised with .phtml extensions, bypassing file type restrictions to achieve full server compromise. The vulnerability stems from inadequate file upload validation in the media handler, enabling malicious files in publicly accessible directories. Upstream fix available via GitHub commit; EPSS data unavailable, no CISA KEV listing at time of analysis.

Technical ContextAI

Vvveb CMS is a lightweight PHP-based content management system. This vulnerability exploits CWE-434 (Unrestricted Upload of File with Dangerous Type) in the media upload handler. The application implements a deny-list approach for file extensions but fails to block .phtml files, which Apache and many PHP-enabled web servers execute as PHP code by default through their MIME type handlers. The uploaded files are stored in a publicly accessible media directory with predictable paths, allowing direct HTTP requests to trigger code execution. This represents a classic filter bypass scenario where alternate file extensions (.phtml, .php3, .php4, .php5, .phar) circumvent incomplete deny-lists that only block .php extensions. The CPE identifier confirms impact to all versions of Vvveb CMS up to and including 1.0.8, though the specific vulnerable code resides in the media upload controller component.

RemediationAI

Apply the upstream fix available in GitHub commit 23ac0e8c758d80f3c4d9224763c8b2359648270e (https://github.com/givanz/Vvveb/commit/23ac0e8c758d80f3c4d9224763c8b2359648270e). Specific patched release version number not confirmed in available data-administrators should pull latest code from the main branch or monitor for a tagged release post-1.0.8. If immediate patching is not feasible, implement these compensating controls: (1) Configure web server to explicitly deny execution of .phtml, .php3, .php4, .php5, and .phar files in the media upload directory via .htaccess (Apache) or location blocks (Nginx)-this prevents code execution but may break legitimate functionality if the CMS relies on these extensions; (2) Restrict authenticated user account creation and audit existing low-privilege accounts, removing those not actively needed-reduces attack surface but does not eliminate risk from compromised or malicious insiders; (3) Deploy web application firewall rules to inspect and block uploads containing PHP code signatures in files with non-.php extensions-may cause false positives requiring tuning. All workarounds are inferior to patching; full remediation requires the vendor fix.