Vulnerability Description
Vvveb before 1.0.8.3 contains an unrestricted file upload vulnerability in the plugin upload endpoint that allows super_admin users to execute arbitrary PHP code by uploading a malicious plugin ZIP file. Attackers can craft a ZIP containing a plugin.php with a valid Slug header and a public/index.php file with arbitrary PHP code, which executes as the web server user when accessed via unauthenticated HTTP requests to the plugin's public path.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/givanz/Vvveb/commit/04f0294350ec429e307cd31c2e777a4797c868d6
- https://github.com/givanz/Vvveb/releases/tag/1.0.8.3
- https://www.vulncheck.com/advisories/vvveb-unrestricted-file-upload-rce-via-plug
FAQ
What is CVE-2026-41937?
CVE-2026-41937 is a vulnerability with a CVSS score of 7.2 (HIGH). Vvveb before 1.0.8.3 contains an unrestricted file upload vulnerability in the plugin upload endpoint that allows super_admin users to execute arbitrary PHP code by uploading a malicious plugin ZIP fi...
How severe is CVE-2026-41937?
CVE-2026-41937 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-41937?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.