Vvveb EUVD-2026-23942

Requires authenticated access with high-privilege administrator credentials to the Vvveb CMS media management interface. Specifically, the attacker must have permissions to upload files and invoke the rename function within the media module-features typically restricted to admin or editor roles. Additionally, the vulnerable Vvveb installation must run on an Apache web server with PHP interpreter support and AllowOverride directives enabled for the media upload directory, permitting .htaccess files to modify runtime configuration. Exploitation is limited by authentication barriers and administrative access controls; default Vvveb installations with strong password policies and IP-restricted admin panels significantly reduce attack surface compared to Internet-exposed instances with weak credentials.

The CVSS:4.0 score of 9.2 reflects network-exploitable remote code execution with high confidentiality, integrity, and availability impact, plus subsequent integrity impact beyond the vulnerable component. However, real-world risk is constrained by the PR:H (high privilege required) vector-exploitation demands authenticated administrator credentials. VulnCheck advisory confirms the vulnerability and GitHub commit demonstrates fix availability, but no CISA KEV listing or EPSS score indicates the flaw is not currently subject to widespread exploitation. SSVC assessment: exploitation status is publicly available exploit code exists (proof-of-concept derivable from vendor advisory), automatable is no (requires prior credential compromise), technical impact is total (arbitrary code execution). Priority depends heavily on exposure of Vvveb admin interfaces to untrusted networks and credential hygiene-organizations with Internet-facing Vvveb installations and weak admin account controls face elevated risk, while isolated deployments with robust authentication see substantially lower urgency despite the critical CVSS score.

An attacker with stolen administrator credentials (obtained via phishing, credential stuffing, or session hijacking) authenticates to the Vvveb CMS admin panel. They navigate to the media management interface and upload a benign text file containing Apache AddType directives mapping arbitrary extensions to application/x-httpd-php. Using the rename function, they change this file to .htaccess, injecting the malicious MIME type configuration into the web root. Next, they upload a second file containing PHP code (e.g., system command invocation via shell_exec) and rename it to a .php extension. Accessing this file via HTTP triggers PHP execution, granting the attacker arbitrary command execution as the www-data user, enabling data exfiltration, lateral movement, or installation of persistent backdoors.