Vulnerability · Published May 6, 2026 · Assigned by VulnCheck

CVE-2026-41936Vvveb < 1.0.8.2 XML External Entity Injection via Import

High 8.1

In plain English

A high-severity XML external entity in Vvveb from givanz. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.3%top 71.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Vvveb before version 1.0.8.2 contains an XML external entity (XXE) injection vulnerability in the admin Tools/Import feature that allows authenticated site_admin users to read arbitrary files and modify database records. Attackers can exploit the XML parser configuration in system/import/xml.php to inject file:// or php://filter entity references that are resolved and persisted into the application database, enabling arbitrary file disclosure and administrator password hash overwriting for privilege escalation.

Affected products (as reported)

Vendor	Product	Versions
givanz	Vvveb	0 – before 1.0.8.2

Weakness: CWE-611 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

https://github.com/givanz/Vvveb/releases/tag/1.0.8.2 release-notes
https://github.com/givanz/Vvveb/security/advisories/GHSA-rfxr-4xpm-wrp7 vendor-advisory
https://github.com/givanz/Vvveb/commit/86f7128a18edebe0ff47e3855558467eb0ef9106 patch
https://www.vulncheck.com/advisories/vvveb-xml-external-entity-injection-via-import third-party-advisory