PT-2026-40944 · Givanz · Vvveb

Basant Kumar + 1 · Published 2026-05-14 · Updated 2026-05-14 · CVE-2026-41937

NVD

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Vvveb before 1.0.8.3 contains an unrestricted file upload vulnerability in the plugin upload endpoint that allows super admin users to execute arbitrary PHP code by uploading a malicious plugin ZIP file. Attackers can craft a ZIP containing a plugin.php with a valid Slug header and a public/index.php file with arbitrary PHP code, which executes as the web server user when accessed via unauthenticated HTTP requests to the plugin's public path.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-61

CWE-434

Related Identifiers

CVE-2026-41937

Affected Products

Vvveb

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-41937 · Security Note
• https://github.com/givanz/Vvveb/commit/04f0294350ec429e307cd31c2e777a4797c868d6 · Patch
• https://github.com/givanz/Vvveb/releases/tag/1.0.8.3 · Note
• https://vulncheck.com/advisories/vvveb-unrestricted-file-upload-rce-via-plugin-upload · Note