CVE-2026-41938: Vvveb < 1.0.8.2 RCE via Media Upload Handler
Vvveb before version 1.0.8.2 contains an unrestricted file upload vulnerability in the media upload handler that allows authenticated users with media-upload permissions to bypass extension restrictions by uploading a .htaccess file to map .phtml extensions to the PHP handler. Attackers can upload a .phtml file containing arbitrary PHP code and execute the uploaded payload through a subsequent unauthenticated HTTP GET request to the uploaded file, resulting in remote code execution with web server privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vvvebto a version that resolves this vulnerability.Fixed in 1.0.8.2 - Compensating control
Restrict access to the media upload handler to prevent authenticated users with media-upload permissions from uploading dangerous files such as .phtml and .htaccess.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41938?
CVE-2026-41938 is classified as a high severity vulnerability due to the potential for remote code execution.
How do I fix CVE-2026-41938?
To fix CVE-2026-41938, upgrade Vvveb to version 1.0.8.2 or later to mitigate the unrestricted file upload vulnerability.
Who is affected by CVE-2026-41938?
CVE-2026-41938 affects all users of Vvveb versions prior to 1.0.8.2 who have media-upload permissions.
What type of vulnerability is CVE-2026-41938?
CVE-2026-41938 is an unrestricted file upload vulnerability that allows authenticated users to upload malicious files.
Can CVE-2026-41938 be exploited by unauthenticated users?
No, CVE-2026-41938 requires authenticated users with media-upload permissions for exploitation.