VVVEB · CVE-2026-126370 · Runtime
NO FIX YET · SEE WHAT TO DO
Vvveb through 1.0.8.6 lets a restricted site_admin role inject PHP by saving .sql files in the admin code editor, using an @IF macro payload that bypasses extension and content deny-lists. The injected code runs when the model loads, giving the attacker OS command execution as the web server user.
first public Oct 29, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted Vvveb CMS installs up to 1.0.8.6 where someone besides the super admin holds the site_admin role. That user can save a .sql file in the admin code editor with an @IF macro that compiles to PHP and runs as the web server user when the model loads. Sites where only the super admin has admin access can skip the escalation risk, but there is no patch yet.
Not affected if managed-hosting, newer-version, no-site-admin-role, no-site-admin-users
Who cares cms, php, self-hosted, vvveb
1.0.8.6 is affected; no fixed release listed)Vvveb through 1.0.8.6 contains a remote code execution vulnerability allowing restricted site_admin roles to inject PHP by saving .sql files through the admin code editor. Attackers can bypass extension and content deny-lists with an @IF macro payload that compiles into executable PHP when the model loads, running OS commands as the web user.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.