CVE-2026-126372: Vvveb through 1.0.8.6 Template Upload Bypass via MediaTrait editor/code
Vvveb through 1.0.8.6 contains an incomplete fix for CVE-2026-41934 that allows authenticated editor or siteadmin users to write server-side templates by bypassing save restrictions. Attackers can upload or rename .tpl files via editor/code upload and rename actions, or evade isExecutableFile checks in save(), to inject PHP code into templates.
Affected Software
Event History
Frequently Asked Questions
Which accounts can exploit this issue?
An authenticated user with either the editor or site_admin role can exploit it. No user interaction is required.
What access does an attacker need to turn the flaw into code execution?
The attacker needs valid editor or site_admin credentials and access to the editor/code upload, rename, or save functionality. They can inject PHP code into server-side template files after bypassing the save restrictions.
Are systems that addressed CVE-2026-41934 necessarily protected?
No. The issue is described as an incomplete fix for CVE-2026-41934, so deployments through version 1.0.8.6 remain affected despite that earlier remediation.
How can defenders look for exploitation attempts?
Review template-related upload, rename, and save activity performed through editor/code functions, especially creation or renaming of .tpl files. Inspect template contents for injected PHP code and investigate actions performed by editor or site_admin accounts.