CVE-2026-41934— Vvveb < 1.0.8.2 Authenticated RCE via Code Editor

Vvveb < 1.0.8.2 Authenticated RCE via Code Editor

Vvveb before version 1.0.8.2 contains an authenticated remote code execution vulnerability in the admin code editor that allows low-privilege authenticated users to execute arbitrary code through insufficient file extension restrictions, with the uploaded payload then executable via subsequent unauthenticated HTTP requests. Attackers with editor, author, contributor, or site_admin roles can write a malicious .htaccess file to map arbitrary extensions to the PHP handler, then upload PHP code with that extension to achieve unauthenticated remote code execution when the file is accessed via HTTP.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

不完整的黑名单

Vvveb 安全漏洞

Vvveb是Givan个人开发者的一个强大且易于使用的CMS，用于构建网站、博客或电子商务商店。 Vvveb 1.0.8.2之前版本存在安全漏洞，该漏洞源于管理员代码编辑器中文件扩展名限制不足，可能导致低权限认证用户上传恶意.htaccess文件，实现远程代码执行。

N/A

N/A