CVE-2026-126378: Vvveb through 1.0.8.6 Webshell Upload via Theme Installer validFile() Bypass
Vvveb through 1.0.8.6 contains a file upload vulnerability in the theme installer validFile() function that uses strpos() instead of strict path matching. Attackers with admin credentials can upload a ZIP containing a PHP file whose path includes /theme.php to achieve remote code execution on nginx deployments.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Vvveb installations through version 1.0.8.6 running on nginx are exposed if an attacker has administrative credentials.
What does an attacker need to exploit this issue?
The attacker needs admin-level access and must be able to upload a crafted ZIP through the theme installer. The ZIP contains a PHP file with a path that includes /theme.php.
What is the impact of successful exploitation?
Successful exploitation allows upload of a webshell and can result in remote code execution with the privileges of the affected web application.
How can I determine whether an installation is affected?
Review whether the deployment uses Vvveb version 1.0.8.6 or earlier, runs on nginx, and permits administrative users to install themes through the theme installer.