PT-2026-33837 · Vvveb Cms · Vvveb Cms

Published 2026-04-20 · Updated 2026-04-21 · CVE-2026-6249

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vvveb CMS version 1.0.8

Description A remote code execution issue exists in the media upload handler. Authenticated attackers can execute arbitrary operating system commands by uploading a PHP webshell using a .phtml extension. This process involves bypassing the extension deny-list to upload malicious files to the publicly accessible media directory and subsequently requesting the file over HTTP to achieve full server compromise.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-6249

Affected Products

Vvveb Cms

References · 4

• https://github.com/givanz/Vvveb/commit/23ac0e8c758d80f3c4d9224763c8b2359648270e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-6249 · Security Note
• https://vulncheck.com/advisories/vvveb-cms-remote-code-execution-via-media-upload · Note
• https://twitter.com/CVEnew/status/2046571903956209827 · Twitter Post