CVE-2026-41936: Vvveb < 1.0.8.2 XML External Entity Injection via Import
Vvveb before version 1.0.8.2 contains an XML external entity (XXE) injection vulnerability in the admin Tools/Import feature that allows authenticated siteadmin users to read arbitrary files and modify database records. Attackers can exploit the XML parser configuration in system/import/xml.php to inject file:// or php://filter entity references that are resolved and persisted into the application database, enabling arbitrary file disclosure and administrator password hash overwriting for privilege escalation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vvvebto a version that resolves this vulnerability.Fixed in 1.0.8.2Patch XML External Entity Injection via Import - Compensating control
Restrict access to the Vvveb admin Tools/Import feature so only necessary authenticated site_admin users can use it, to reduce exposure of the XXE injection vulnerability in versions before 1.0.8.2.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41936?
CVE-2026-41936 is rated as a high severity vulnerability due to its potential to allow unauthorized file access and database modification.
Who is affected by CVE-2026-41936?
CVE-2026-41936 affects Vvveb users running versions prior to 1.0.8.2.
How do I fix CVE-2026-41936?
The vulnerability can be fixed by upgrading to Vvveb version 1.0.8.2 or later.
What type of vulnerability is CVE-2026-41936?
CVE-2026-41936 is classified as an XML External Entity (XXE) injection vulnerability.
What can attackers do with CVE-2026-41936?
Attackers can exploit CVE-2026-41936 to read arbitrary files and modify database records.