CVE-2026-126370: Vvveb through 1.0.8.6 Authenticated RCE via .sql Code Injection in editor/code/save
Vvveb through 1.0.8.6 contains a remote code execution vulnerability allowing restricted siteadmin roles to inject PHP by saving .sql files through the admin code editor. Attackers can bypass extension and content deny-lists with an @IF macro payload that compiles into executable PHP when the model loads, running OS commands as the web user.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with the restricted site_admin role can exploit it. No user interaction is required, and the vulnerable editor/code/save functionality must be accessible to that role.
What access does successful exploitation provide?
The injected payload is compiled into executable PHP when the model loads, allowing OS commands to run as the web user. This can affect confidentiality, integrity, and availability at the privilege level of that web-user account.
How does the payload bypass existing editor protections?
The attacker saves a .sql file containing an @IF macro payload. That payload bypasses extension and content deny-lists and becomes executable PHP during model loading.