Which versions of PHP are affected by CVE-2026-6257?

Vvveb CMS v1.0.8 contains a critical remote code execution vulnerability affecting authenticated administrators, allowing attackers with admin credentials to execute arbitrary system commands on the…

How to fix or mitigate CVE-2026-6257?

Within 24 hours: Inventory all Vvveb CMS deployments and document current version numbers. Within 7 days: Restrict administrative access to CMS instances running v1.0.8 to trusted users only, and disable the media management file upload functionality if possible via configuration. Within 30 days: Upgrade to a patched version confirmed to include commit 6fb8eaa or later, or migrate to an alternative CMS solution if no official release is available.

PHP CVE-2026-6257

Q: What is the CVSS score of CVE-2026-6257?

CVE-2026-6257 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-23942 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-04-20 VulnCheck

GHSA-c9rc-p9cp-2x7q

Apache File Upload RCE PHP

9.2

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 21, 2026 - 16:22 vuln.today

cvss_changed

Analysis Generated

Apr 20, 2026 - 20:32 vuln.today

CVSS changed

Apr 20, 2026 - 20:22 NVD

9.1 (CRITICAL) 9.2 (CRITICAL)

EUVD ID Assigned

Apr 20, 2026 - 20:00 euvd

EUVD-2026-23942

Analysis Generated

Apr 20, 2026 - 20:00 vuln.today

CVE Published

Apr 20, 2026 - 19:09 nvd

CRITICAL 9.2

DescriptionCVE.org

Vvveb CMS v1.0.8 contains a remote code execution vulnerability in its media management functionality where a missing return statement in the file rename handler allows authenticated attackers to rename files to blocked extensions .php or .htaccess. Attackers can exploit this logic flaw by first uploading a text file and renaming it to .htaccess to inject Apache directives that register PHP-executable MIME types, then uploading another file and renaming it to .php to execute arbitrary operating system commands as the www-data user.

AnalysisAI

Remote code execution in Vvveb CMS v1.0.8 allows authenticated administrators to execute arbitrary system commands as www-data via a two-stage file upload attack. Attackers exploit a logic flaw in the media management file rename handler that fails to block .php and .htaccess extensions, enabling MIME type manipulation followed by PHP code execution. VulnCheck published an advisory and GitHub commit 6fb8eaa confirms upstream fix. No EPSS data available; no active exploitation confirmed at time of analysis.

Technical ContextAI

Vvveb is an open-source PHP-based content management system. This vulnerability exploits CWE-434 (Unrestricted Upload of File with Dangerous Type) through a missing return statement in the file rename validation logic within the media management module. The flaw permits authenticated users to bypass extension blocklists that should prevent renaming files to .php or .htaccess. Apache's .htaccess configuration file mechanism allows per-directory runtime directives, including AddType declarations that can associate arbitrary file extensions with PHP MIME types. By chaining these capabilities-first uploading a benign file and renaming to .htaccess to inject MIME type mappings, then uploading a second file and renaming to .php-an attacker gains arbitrary code execution within the Apache process context (typically the www-data user on Debian-based systems).

RemediationAI

Apply the upstream fix by upgrading to the commit following 6fb8eaa998265e33e8802cbc220d8859dbc144f2 available at https://github.com/givanz/Vvveb/commit/6fb8eaa998265e33e8802cbc220d8859dbc144f2, which corrects the missing return statement in the file rename validation logic. No tagged release version incorporating this fix was independently confirmed at time of analysis-verify current repository HEAD or request release timeline from the Vvveb project. If immediate patching is not feasible, implement compensating controls: restrict admin panel access to trusted internal IP ranges via Apache Allow/Deny directives or web application firewall rules (trade-off: limits legitimate remote administration), disable the media management file rename functionality by removing write permissions on the media upload directory for the www-data user (trade-off: breaks legitimate rename workflows), or implement Apache-level restrictions to prevent execution of .php files in the media upload directory via php_flag engine off in .htaccess (trade-off: requires server-level AllowOverride configuration and does not mitigate .htaccess injection itself). Review all admin accounts for compromised credentials and enforce multi-factor authentication to reduce privilege escalation vectors.