Vulnerability · Published Apr 20, 2026 · Assigned by VulnCheck
CVE-2026-6249Vvveb CMS 1.0.8.2 Remote Code Execution via Media Upload
High 8.8
In plain English
A high-severity unrestricted file upload in Vvveb CMS from Vvveb. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).
Official description
Vvveb CMS 1.0.8.2 contains a remote code execution vulnerability in its media upload handler that allows authenticated attackers to execute arbitrary operating system commands by uploading a PHP webshell with a .phtml extension. Attackers can bypass the extension deny-list and upload malicious files to the publicly accessible media directory, then request the file over HTTP to achieve full server compromise.
Affected products (as reported)
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- Patch Commit patch
- https://www.vulncheck.com/advisories/vvveb-cms-remote-code-execution-via-media-upload third-party-advisory