CVE-2026-41937

Vvveb < 1.0.8.3 Unrestricted File Upload RCE via Plugin Upload

State: Published
Severity: 8.6 High
Published: May 14, 2026
Updated: Jul 28, 2026
Reserved: Apr 22, 2026

Description

Vvveb before 1.0.8.3 contains an unrestricted file upload vulnerability in the plugin upload endpoint that allows super_admin users to execute arbitrary PHP code by uploading a malicious plugin ZIP file. Attackers can craft a ZIP containing a plugin.php with a valid Slug header and a public/index.php file with arbitrary PHP code, which executes as the web server user once accessed via subsequent unauthenticated HTTP requests to the plugin's public path.

Scores

CVSS	Score	Vector	Source
4.0	8.6 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	VulnCheck
3.1	7.2 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	VulnCheck

Weaknesses

CWE-434 Unrestricted Upload of File with Dangerous Type
CWE-61 UNIX Symbolic Link (Symlink) Following

Affected Products

Product	Versions
Vvvebgivanz	before 1.0.8.3Affected 04f0294350ec429e307cd31c2e777a4797c868d6Not affected

References

https://github.com/givanz/Vvveb/releases/tag/1.0.8.3release-notes
https://github.com/givanz/Vvveb/commit/04f0294350ec429e307cd31c2e777a4797c868d6patch
https://www.vulncheck.com/advisories/vvveb-unrestricted-file-upload-rce-via-plugin-uploadthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.