{"id":"CVE-2026-126370","kind":"vulnerability","aliases":["CVE-2026-126370"],"related":[],"title":"Vvveb CMS: site admin can save PHP through code editor, running commands","description":"Vvveb through 1.0.8.6 contains a remote code execution vulnerability allowing restricted site_admin roles to inject PHP by saving .sql files through the admin code editor. Attackers can bypass extension and content deny-lists with an @IF macro payload that compiles into executable PHP when the model loads, running OS commands as the web user.","summary":"Vvveb through 1.0.8.6 lets a restricted site_admin role inject PHP by saving .sql files in the admin code editor, using an @IF macro payload that bypasses extension and content deny-lists. The injected code runs when the model loads, giving the attacker OS command execution as the web server user.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Vvveb","fixed":[],"affected":"<= 1.0.8.6","ecosystem":"composer"}],"ecosystems":[],"tags":["cms","php","runtime","self-hosted","vvveb"],"not_affected_if":["managed-hosting","newer-version","no-site-admin-role","no-site-admin-users"],"how_to_check":"Check the installed Vvveb version (<= 1.0.8.6 is affected; no fixed release listed). List who holds the site_admin role. Look in plugins/*/sql/*/*.sql for lines starting with @IF whose condition holds PHP calls (file_put_contents, shell_exec, system), and in storage/model/ for generated models containing them.","fix":"No patched version as of the 2026-10-29 GitHub advisory (patched versions: None). Until one ships, restrict the site_admin role and the admin code editor.","status":"open","published_at":"2026-11-13T10:17:39+00:00","first_seen_at":"2026-11-13T10:47:16+00:00","triaged_at":"2026-11-13T10:49:00+00:00","updated_at":"2026-11-13T10:52:07+00:00","category":"runtime","confidence":0.85,"triage":{"at":"2026-11-13T10:49:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Vvveb CMS: site admin can save PHP through code editor, running commands","impact":"high","summary":"Vvveb through 1.0.8.6 lets a restricted site_admin role inject PHP by saving .sql files in the admin code editor, using an @IF macro payload that bypasses extension and content deny-lists. The injected code runs when the model loads, giving the attacker OS command execution as the web server user.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["vvveb","php","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs OS commands as the web server user","analyst_note":"Confirm the fixed version and any vendor patch from the GitHub advisory and VulnCheck page; the sources here do not state a fix.","how_to_check":"- Check whether the Vvveb version in use is through `1.0.8.6` (the vendor's fixed version is not stated in the sources)\n- Review who holds the site_admin role and whether the admin code editor is reachable","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-site-admin-users","newer-version"],"who_is_affected":"Sites running Vvveb through 1.0.8.6 where users hold the restricted site_admin role, since that role can reach the admin code editor. Installations where no one holds site_admin, or where the code editor is not reachable, have a smaller exposure. The sources do not state a fixed version or a specific configuration beyond this.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000747,"input_tokens":4611,"output_tokens":571,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and any vendor patch from the GitHub advisory and VulnCheck page; the sources here do not state a fix.","search":"'-126370':15A,18A '-2026':14A,17A '1.0.8.6':29B,81C 'admin':4A,34B,44B,91C,102C 'allow':88C 'attack':70B,105C 'bypass':53B,107C 'cms':2A,20B 'code':9A,45B,62B,85C,103C 'command':12A,72B,130C 'compil':120C 'contain':82C 'content':56B,110C 'cve':13A,16A 'deni':58B,112C 'deny-list':57B,111C 'editor':10A,46B,104C 'execut':73B,86C,122C 'extens':54B,108C 'file':41B,99C 'give':68B 'host':25B 'inject':36B,61B,94C 'let':30B 'list':59B,113C 'load':67B,127C 'macro':50B,117C 'model':66B,126C 'os':71B,129C 'payload':51B,118C 'php':7A,21B,37B,95C,123C 'remot':84C 'restrict':32B,89C 'role':35B,92C 'run':11A,63B,128C 'runtim':22B 'save':6A,39B,97C 'self':24B 'self-host':23B 'server':77B 'site':3A,33B,90C 'sql':40B,98C 'use':47B 'user':78B,134C 'vulner':87C 'vvveb':1A,19A,26B,27B,79C 'web':76B,133C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Vvveb CMS installs up to 1.0.8.6 where someone besides the super admin holds the site_admin role. That user can save a .sql file in the admin code editor with an @IF macro that compiles to PHP and runs as the web server user when the model loads. Sites where only the super admin has admin access can skip the escalation risk, but there is no patch yet.","tier":"B","verified":{"fix":{"at":"2026-11-13T10:52:07Z","by":"analyst","doc":"https://github.com/givanz/Vvveb/security/advisories/GHSA-2mq4-4q7r-q52q","run_id":3862},"products":{"at":"2026-11-13T10:52:07Z","by":"analyst","doc":"https://github.com/givanz/Vvveb/security/advisories/GHSA-2mq4-4q7r-q52q","run_id":3862},"how_to_check":{"at":"2026-11-13T10:52:07Z","by":"analyst","doc":"https://github.com/givanz/Vvveb/security/advisories/GHSA-2mq4-4q7r-q52q","run_id":3862},"who_affected":{"at":"2026-11-13T10:52:07Z","by":"analyst","doc":"https://github.com/givanz/Vvveb/security/advisories/GHSA-2mq4-4q7r-q52q","run_id":3862}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["vvveb"],"ptokens":["vvveb"],"labels":["cms","high","php","runtime","selfhosted","vvveb"],"campaign_type":null,"search_a":"'-126370':15A,18A '-2026':14A,17A 'admin':4A 'cms':2A 'code':9A 'command':12A 'cve':13A,16A 'editor':10A 'php':7A 'run':11A 'save':6A 'site':3A 'vvveb':1A,19A","search_b":"'1.0.8.6':29B 'admin':34B,44B 'attack':70B 'bypass':53B 'cms':20B 'code':45B,62B 'command':72B 'content':56B 'deni':58B 'deny-list':57B 'editor':46B 'execut':73B 'extens':54B 'file':41B 'give':68B 'host':25B 'inject':36B,61B 'let':30B 'list':59B 'load':67B 'macro':50B 'model':66B 'os':71B 'payload':51B 'php':21B,37B 'restrict':32B 'role':35B 'run':63B 'runtim':22B 'save':39B 'self':24B 'self-host':23B 'server':77B 'site':33B 'sql':40B 'use':47B 'user':78B 'vvveb':26B,27B 'web':76B","search_c":"'1.0.8.6':81C 'admin':91C,102C 'allow':88C 'attack':105C 'bypass':107C 'code':85C,103C 'command':130C 'compil':120C 'contain':82C 'content':110C 'deni':112C 'deny-list':111C 'editor':104C 'execut':86C,122C 'extens':108C 'file':99C 'inject':94C 'list':113C 'load':127C 'macro':117C 'model':126C 'os':129C 'payload':118C 'php':95C,123C 'remot':84C 'restrict':89C 'role':92C 'run':128C 'save':97C 'site':90C 'sql':98C 'user':134C 'vulner':87C 'vvveb':79C 'web':133C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-29T01:14:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126370","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126370","severity":null,"published_at":"2026-11-13T10:17:39+00:00","modified_at":"2026-11-13T10:17:39+00:00","first_seen_at":"2026-11-13T10:47:16+00:00","fetched_at":"2026-11-13T10:47:16+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126370:3862","url":null,"severity":null,"published_at":"2026-11-13T10:52:07+00:00","modified_at":"2026-11-13T10:52:07+00:00","first_seen_at":"2026-11-13T10:52:07+00:00","fetched_at":"2026-11-13T10:52:07+00:00","note":"GHSA-2mq4-4q7r-q52q (vendor repo) lists patched versions: None; affected <= 1.0.8.6; incomplete fix of CVE-2026-41934 (fixed 1.0.8.2). No exploitation or public mitigation seen; PoC is in the advisory."}],"documents":[{"id":144981,"url":"https://github.com/givanz/Vvveb/security/advisories/GHSA-2mq4-4q7r-q52q","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-29T01:14:11+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144982,"url":"https://www.vulncheck.com/advisories/vvveb-through-1.0.8.6-authenticated-rce-via-sql-code-injection-in-editor-code-save","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}