Vulnerability · Published Apr 20, 2026 · Assigned by VulnCheck
CVE-2026-6257Vvveb CMS < v1.0.8.2 Remote Code Execution via Media Management
Critical 9.1
In plain English
A critical-severity unrestricted file upload in Vvveb CMS from Vvveb. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).
Official description
Vvveb CMS before 1.0.8.2 contains a remote code execution vulnerability in its media management functionality where a missing return statement in the file rename handler allows authenticated attackers to rename files to blocked extensions .php or .htaccess. Attackers can exploit this logic flaw by first uploading a text file and renaming it to .htaccess to inject Apache directives that register PHP-executable MIME types, then uploading another file and renaming it to .php to execute arbitrary operating system commands as the www-data user.
Affected products (as reported)
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
References
- Patch Commit patch
- https://www.vulncheck.com/advisories/vvveb-cms-remote-code-execution-via-media-management third-party-advisory