CVE-2026-6249: Vvveb CMS 1.0.8.2 Remote Code Execution via Media Upload
Vvveb CMS 1.0.8.2 contains a remote code execution vulnerability in its media upload handler that allows authenticated attackers to execute arbitrary operating system commands by uploading a PHP webshell with a .phtml extension. Attackers can bypass the extension deny-list and upload malicious files to the publicly accessible media directory, then request the file over HTTP to achieve full server compromise.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6249?
CVE-2026-6249 is rated as critical due to its potential for remote code execution by authenticated attackers.
How do I mitigate CVE-2026-6249?
To mitigate CVE-2026-6249, remove or restrict the ability to upload files with .phtml extensions in Vvveb CMS 1.0.8.
Who is affected by CVE-2026-6249?
CVE-2026-6249 affects Vvveb CMS version 1.0.8.
What type of vulnerability is CVE-2026-6249?
CVE-2026-6249 is a remote code execution vulnerability.
Can CVE-2026-6249 be exploited without authentication?
No, CVE-2026-6249 requires authenticated access for exploitation.