EUVD-2026-27893Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
Vvveb before version 1.0.8.2 contains an unrestricted file upload vulnerability in the media upload handler that allows authenticated users with media-upload permissions to bypass extension restrictions by uploading a .htaccess file to map .phtml extensions to the PHP handler. Attackers can upload a .phtml file containing arbitrary PHP code and trigger execution by sending an unauthenticated HTTP GET request to the uploaded file, resulting in remote code execution with web server privileges.
AnalysisAI
Remote code execution in Vvveb CMS versions before 1.0.8.2 allows authenticated users with media-upload permissions to execute arbitrary PHP code with web server privileges via a two-stage attack: uploading a malicious .htaccess file to map .phtml extensions to the PHP handler, then uploading a .phtml file containing PHP code. Exploitation requires only low-privileged authentication (CVSS PR:L) and no user interaction (UI:N), making post-authentication compromise straightforward. Vendor-released patch available in version 1.0.8.2 per GitHub security advisory GHSA-wwmv-4g9g-p48g and commit 54a9e846. VulnCheck advisory provides detailed technical analysis of the bypass technique.
Technical ContextAI
This vulnerability exploits unrestricted file upload (CWE-434) combined with Apache .htaccess configuration override capabilities. Vvveb's media upload handler fails to prevent .htaccess file uploads, enabling attackers to reconfigure the web server's file type handling at runtime. By uploading a .htaccess file containing 'AddType application/x-httpd-php .phtml' (or similar directives), attackers map previously benign .phtml extensions to the PHP interpreter. Subsequent .phtml file uploads containing PHP code (e.g., <?php system($_GET['cmd']); ?>) are then executed by the server when accessed via HTTP GET requests. The affected product is identified as cpe:2.3:a:givanz:vvveb:*:*:*:*:*:*:*:* with versions prior to 1.0.8.2 vulnerable. This attack pattern is common in PHP-based CMSs running on Apache with AllowOverride enabled, where insufficient upload validation meets overly permissive .htaccess processing.
RemediationAI
Upgrade immediately to Vvveb version 1.0.8.2 or later, available from https://github.com/givanz/Vvveb/releases/tag/1.0.8.2. The security fix is implemented in commit 54a9e846fb94192f1b31ae81d81d25c874662e6a (https://github.com/givanz/Vvveb/commit/54a9e846fb94192f1b31ae81d81d25c874662e6a) - review commit diff to understand validation improvements. For environments unable to patch immediately, implement these compensating controls with noted trade-offs: (1) Configure Apache with 'AllowOverride None' in VirtualHost or Directory directives to prevent .htaccess processing - this breaks any legitimate .htaccess functionality Vvveb may rely on for URL rewriting or access control, requiring manual migration of those rules to httpd.conf. (2) Restrict media-upload permissions to only highly trusted administrator accounts and audit existing accounts with these permissions - reduces attack surface but impacts content workflow efficiency. (3) Implement file upload validation at the web server level using mod_security or similar WAF rules to block .htaccess uploads - adds operational complexity and may have performance impact. (4) If using nginx instead of Apache, .htaccess files are ignored by default, though underlying upload validation weakness remains. After patching, conduct forensic review of existing uploaded files in media directories for unexpected .htaccess or .phtml files as indicators of prior compromise.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Share
External POC / Exploit Code
Leaving vuln.today