PT-2026-38221 · Vvveb · Vvveb

Basant Kumar + 2 · CVE-2026-41934 · Published 2026-05-06 · Updated 2026-05-06

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vvveb versions prior to 1.0.8.2

Description The admin code editor allows authenticated users with low privileges, such as editor, author, contributor, or site admin roles, to execute arbitrary code. This is possible due to insufficient file extension restrictions, enabling attackers to write a malicious .htaccess file to map arbitrary extensions to the PHP handler. Subsequently, PHP code can be uploaded using those extensions to achieve remote code execution when the file is accessed via HTTP.

Recommendations Update to version 1.0.8.2 or later.

Exploit

Fix

RCE

Incomplete List of Disallowed Inputs

Weakness Enumeration

CWE-184

Related Identifiers

CVE-2026-41934

GHSA-VFJJ-GCVV-W248

Affected Products

Vvveb

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41934.json · Exploit
• https://github.com/givanz/Vvveb/commit/1196561276a3f49da5a714fef89ac9a6c6f9e33b · Patch
• https://github.com/givanz/Vvveb/security/advisories/GHSA-vfjj-gcvv-w248 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41934 · Security Note
• https://osv.dev/vulnerability/CVE-2026-41934 · Vendor Advisory
• https://github.com/givanz/Vvveb/releases/tag/1.0.8.2 · Note
• https://twitter.com/CVEnew/status/2052112622510559268 · Twitter Post
• https://vulncheck.com/advisories/vvveb-authenticated-rce-via-code-editor · Note