CVE-2026-41929: Vvveb < 1.0.8.2 Unauthenticated Reflected XSS via Visual Editor
Vvveb before 1.0.8.2 contains an unauthenticated reflected cross-site scripting vulnerability in the visual editor preview renderer that allows attackers to execute arbitrary JavaScript by manipulating the r query parameter and componentajax POST parameter. Attackers can craft a malicious link or auto-submitted form that causes victims to execute attacker-controlled JavaScript in the context of the Vvveb origin, as the gating function isEditor() performs no session, role, or token verification and the view handler injects raw HTML POST body content without sanitization.
Other sources
Vvveb before version 1.0.8.2 contains an unrestricted file upload vulnerability in the media upload handler that allows authenticated users with media-upload permissions to bypass extension restrictions by uploading a .htaccess file to map .phtml extensions to the PHP handler. Attackers can upload a .phtml file containing arbitrary PHP code and execute the uploaded payload through a subsequent unauthenticated HTTP GET request to the uploaded file, resulting in remote code execution with web server privileges.
— OSV
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vvvebto a version that resolves this vulnerability.Fixed in 1.0.8.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41929?
CVE-2026-41929 has a high severity rating due to its ability to allow unauthenticated attackers to execute arbitrary JavaScript.
How do I fix CVE-2026-41929?
To fix CVE-2026-41929, you should upgrade to Vvveb version 1.0.8.2 or later.
What type of vulnerability is CVE-2026-41929?
CVE-2026-41929 is an unauthenticated reflected cross-site scripting (XSS) vulnerability.
Who is affected by CVE-2026-41929?
Users of Vvveb versions prior to 1.0.8.2 are affected by CVE-2026-41929.
What can attackers do with CVE-2026-41929?
Attackers can exploit CVE-2026-41929 to manipulate the r query parameter and execute arbitrary JavaScript in the visual editor.