PT-2026-38222 · Vvveb · Vvveb

Basant Kumar + 1 · CVE-2026-41936 · Published 2026-05-06 · Updated 2026-05-06

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Vvveb versions prior to 1.0.8.2

Description An XML external entity (XXE) injection issue exists in the admin Tools/Import feature. Authenticated site admin users can exploit the XML parser configuration in the 'system/import/xml.php' endpoint to inject file:// or php://filter entity references. These references are resolved and persisted into the application database, allowing for arbitrary file disclosure and the overwriting of administrator password hashes to achieve privilege escalation.

Recommendations Update to version 1.0.8.2 or later. As a temporary workaround, restrict access to the 'system/import/xml.php' endpoint.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2026-41936

GHSA-RFXR-4XPM-WRP7

Affected Products

Vvveb

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41936.json · Exploit
• 🔥 https://github.com/givanz/Vvveb/security/advisories/GHSA-rfxr-4xpm-wrp7 · Exploit
• https://github.com/givanz/Vvveb/commit/86f7128a18edebe0ff47e3855558467eb0ef9106 · Patch
• https://osv.dev/vulnerability/CVE-2026-41936 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41936 · Security Note
• https://github.com/givanz/Vvveb/releases/tag/1.0.8.2 · Note
• https://vulncheck.com/advisories/vvveb-xml-external-entity-injection-via-import · Note
• https://twitter.com/CVEnew/status/2052112623424950613 · Twitter Post