CVE-2026-41938: Vvveb < 1.0.8.2 RCE via Media Upload Handler
Vvveb before 1.0.8.2 contains an unauthenticated reflected cross-site scripting vulnerability in the visual editor preview renderer that allows attackers to execute arbitrary JavaScript by manipulating the r query parameter and componentajax POST parameter. Attackers can craft a malicious link or auto-submitted form that causes victims to execute attacker-controlled JavaScript in the context of the Vvveb origin, as the gating function isEditor() performs no session, role, or token verification and the view handler injects raw HTML POST body content without sanitization.
Other sources
Vvveb before version 1.0.8.2 contains an unrestricted file upload vulnerability in the media upload handler that allows authenticated users with media-upload permissions to bypass extension restrictions by uploading a .htaccess file to map .phtml extensions to the PHP handler. Attackers can upload a .phtml file containing arbitrary PHP code and execute the uploaded payload through a subsequent unauthenticated HTTP GET request to the uploaded file, resulting in remote code execution with web server privileges.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vvvebto a version that resolves this vulnerability.Fixed in 1.0.8.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41938?
CVE-2026-41938 is classified as a high severity vulnerability due to the potential for remote code execution.
How do I fix CVE-2026-41938?
To fix CVE-2026-41938, upgrade Vvveb to version 1.0.8.2 or later to mitigate the unrestricted file upload vulnerability.
Who is affected by CVE-2026-41938?
CVE-2026-41938 affects all users of Vvveb versions prior to 1.0.8.2 who have media-upload permissions.
What type of vulnerability is CVE-2026-41938?
CVE-2026-41938 is an unrestricted file upload vulnerability that allows authenticated users to upload malicious files.
Can CVE-2026-41938 be exploited by unauthenticated users?
No, CVE-2026-41938 requires authenticated users with media-upload permissions for exploitation.