CVE-2026-41934

Katalog CVE

CVSS 8.8 · High EPSS 0,95%

Kerentanan Incomplete List of Disallowed Inputs. Skor CVSS 3.1 8.8 (High) menurut vulncheck.com.

Deskripsi (NVD)

Vvveb before version 1.0.8.2 contains an authenticated remote code execution vulnerability in the admin code editor that allows low-privilege authenticated users to execute arbitrary code through insufficient file extension restrictions, with the uploaded payload then executable via subsequent unauthenticated HTTP requests. Attackers with editor, author, contributor, or site_admin roles can write a malicious .htaccess file to map arbitrary extensions to the PHP handler, then upload PHP code with that extension to achieve unauthenticated remote code execution when the file is accessed via HTTP.

Rincian

Terbit di NVD

6 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

8.8 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-184: Incomplete List of Disallowed Inputs

EPSS (30 hari)

0,95% peluang dieksploitasi; lebih tinggi dari 60,3% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/givanz/Vvveb/commit/1196561276a3f49da5a714fef89ac9a6c6f9e33b
• https://github.com/givanz/Vvveb/releases/tag/1.0.8.2
• https://github.com/givanz/Vvveb/security/advisories/GHSA-vfjj-gcvv-w248
• https://www.vulncheck.com/advisories/vvveb-authenticated-rce-via-code-editor