CVE-2026-41937

Vvveb before 1.0.8.3 contains an unrestricted file upload vulnerability in the plugin upload endpoint that allows super_admin users to execute arbitrary PHP code by uploading a malicious plugin ZIP file. Attackers can craft a ZIP containing a plugin.php with a valid Slug header and a public/index.php file with arbitrary PHP code, which executes as the web server user once accessed via subsequent unauthenticated HTTP requests to the plugin's public path.

Score

CVSS 4.0 8.6 High

Status

Deferred - disclosure@vulncheck.com

Published

2026-05-14

Last modified

2026-10-26

Weaknesses

CWE-434, CWE-61

Affected products

• Vvveb (Vvveb)

References

• https://github.com/givanz/Vvveb/releases/tag/1.0.8.3
• https://github.com/givanz/Vvveb/commit/04f0294350ec429e307cd31c2e777a4797c868d6
• https://www.vulncheck.com/advisories/vvveb-unrestricted-file-upload-rce-via-plugin-upload