CVE-2026-41934— Vvveb < 1.0.8.2 Authenticated RCE via Code Editor
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-41934
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Vvveb < 1.0.8.2 Authenticated RCE via Code Editor
Source: NVD (National Vulnerability Database)
Vulnerability Description
Vvveb before version 1.0.8.2 contains an authenticated remote code execution vulnerability in the admin code editor that allows low-privilege authenticated users to execute arbitrary code by exploiting insufficient file extension restrictions. Attackers with editor, author, contributor, or site_admin roles can write a malicious .htaccess file to map arbitrary extensions to the PHP handler, then upload PHP code with that extension to achieve unauthenticated remote code execution when the file is accessed via HTTP.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
不完整的黑名单
Source: NVD (National Vulnerability Database)
Vulnerability Title
Vvveb 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Vvveb是Givan个人开发者的一个强大且易于使用的CMS，用于构建网站、博客或电子商务商店。 Vvveb 1.0.8.2之前版本存在安全漏洞，该漏洞源于管理员代码编辑器中文件扩展名限制不足，可能导致低权限认证用户上传恶意.htaccess文件，实现远程代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-41934
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
Qwen3.6-35B-A3B · 9219 chars
Paid plan includes:
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-41934
请登录查看更多情报信息。
- Vvveb < 1.0.8.2 Authenticated RCE via Code Editor | Advisories | VulnCheckthird-party-advisory
- Release Vvveb 1.0.8.2 · givanz/Vvveb · GitHubrelease-notes
- https://nvd.nist.gov/vuln/detail/CVE-2026-41934
Same Patch Batch · givanz · 2026-05-06 · 5 CVEs total
| CVE-2026-41930 | 9.8 CRITICAL | Vvveb < 1.0.8.2 Hard-coded Credentials Information Disclosure via phpMyAdmin |
| CVE-2026-41938 | 8.8 HIGH | Vvveb < 1.0.8.2 RCE via Media Upload Handler |
| CVE-2026-41936 | 8.1 HIGH | Vvveb < 1.0.8.2 XML External Entity Injection via Import |
| CVE-2026-41931 | 5.3 MEDIUM | Vvveb < 1.0.8.2 Information Disclosure via Debug Exception Handler |
IV. Related Vulnerabilities
Same product: Vvveb
- CVE-2026-41928
Vvveb < 1.0.8.2 Information Disclosure via Cron Controller - CVE-2026-41929
Vvveb < 1.0.8.2 Unauthenticated Reflected XSS via Visual Edi - CVE-2026-41938
Vvveb < 1.0.8.2 RCE via Media Upload Handler - CVE-2026-41930
Vvveb < 1.0.8.2 Hard-coded Credentials Information Disclosur - CVE-2026-41931
Vvveb < 1.0.8.2 Information Disclosure via Debug Exception H
Same vendor: givanz
- CVE-2026-41928
Vvveb < 1.0.8.2 Information Disclosure via Cron Controller - CVE-2026-41929
Vvveb < 1.0.8.2 Unauthenticated Reflected XSS via Visual Edi - CVE-2026-41938
Vvveb < 1.0.8.2 RCE via Media Upload Handler - CVE-2026-41930
Vvveb < 1.0.8.2 Hard-coded Credentials Information Disclosur - CVE-2026-41931
Vvveb < 1.0.8.2 Information Disclosure via Debug Exception H
Same weakness: CWE-184
- CVE-2026-44115
OpenClaw < 2026.4.22 - Shell Expansion Bypass in Unquoted He - CVE-2026-44114
OpenClaw < 2026.4.20 - Environment Variable Namespace Collis - CVE-2026-43584
OpenClaw < 2026.4.10 - Insufficient Environment Variable Den - CVE-2026-43578
OpenClaw 2026.3.31 < 2026.4.10 - Privilege Escalation via Mi - CVE-2026-43566
OpenClaw 2026.4.7 < 2026.4.14 - Privilege Escalation via Unt
V. Comments for CVE-2026-41934
No comments yet