CVE-2026-126380: Vvveb before 1.0.9.0 RCE via .phar Extension Denylist Bypass in Media Upload
Vvveb before 1.0.9.0 contains a denylist bypass in system/traits/media.php where '.phar' is misconfigured with a leading dot, allowing authenticated administrators to upload .phar PHP files. Attackers can upload a GIF magic-byte polyglot webshell bypassing binary inspection and execute arbitrary OS commands as the web-server user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.0.9.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Vvveb administrator can exploit it. The attacker needs access to the media-upload functionality and can then upload a crafted .phar file that bypasses the upload checks.
What level of access could successful exploitation provide?
Successful exploitation allows arbitrary operating-system command execution as the web-server user. The impact includes high confidentiality, integrity, and availability consequences.
Which deployments are affected?
Vvveb versions before 1.0.9.0 are affected. Exploitation depends on an attacker having authenticated administrator privileges.
How can I check for possible exploitation?
Review media uploads for .phar files, including files that appear to be GIF images or other image-like polyglots. Also investigate web-server activity for commands executed by the web-server user after suspicious uploads.