PT-2026-38223 · Vvveb · Vvveb

Basant Kumar + 1 · Published 2026-05-06 · Updated 2026-05-06 · CVE-2026-41938

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vvveb versions prior to 1.0.8.2

Description An unrestricted file upload issue exists in the media upload handler. Authenticated users with media-upload permissions can bypass extension restrictions by uploading a .htaccess file to map .phtml extensions to the PHP handler. This allows the upload of a .phtml file containing arbitrary PHP code, which can be executed by sending an unauthenticated HTTP GET request to the uploaded file, leading to remote code execution with web server privileges.

Recommendations Update to version 1.0.8.2 or later.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-41938

Affected Products

Vvveb

References · 6

• 🔥 https://github.com/givanz/Vvveb/security/advisories/GHSA-wwmv-4g9g-p48g · Exploit
• https://github.com/givanz/Vvveb/commit/54a9e846fb94192f1b31ae81d81d25c874662e6a · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-41938 · Security Note
• https://github.com/givanz/Vvveb/releases/tag/1.0.8.2 · Note
• https://twitter.com/CVEnew/status/2052112619541024849 · Twitter Post
• https://vulncheck.com/advisories/vvveb-rce-via-media-upload-handler · Note