CVE-2026-41937: Vvveb < 1.0.8.3 Unrestricted File Upload RCE via Plugin Upload
Vvveb before 1.0.8.3 contains an unrestricted file upload vulnerability in the plugin upload endpoint that allows superadmin users to execute arbitrary PHP code by uploading a malicious plugin ZIP file. Attackers can craft a ZIP containing a plugin.php with a valid Slug header and a public/index.php file with arbitrary PHP code, which executes as the web server user once accessed via subsequent unauthenticated HTTP requests to the plugin's public path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vvvebto a version that resolves this vulnerability.Fixed in 1.0.8.3 - Compensating control
Prevent unauthenticated access to the plugin upload endpoint (and the plugin public path) using network controls such as firewall/ACL so that only authorized administrative users can reach it over HTTP.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41937?
CVE-2026-41937 has a critical severity due to its ability to allow remote code execution through unrestricted file uploads.
How do I fix CVE-2026-41937?
To fix CVE-2026-41937, upgrade Vvveb to version 1.0.8.3 or later where the vulnerability has been patched.
Who is affected by CVE-2026-41937?
CVE-2026-41937 affects all Vvveb versions prior to 1.0.8.3 that allow super_admin users to upload plugins.
What kind of attack does CVE-2026-41937 facilitate?
CVE-2026-41937 facilitates arbitrary PHP code execution through malicious plugin ZIP file uploads.
What are the implications of CVE-2026-41937?
The implications of CVE-2026-41937 include potential complete server compromise as attackers can execute arbitrary code.