VVVEB · CVE-2026-126372 · Package
NO FIX YET · SEE WHAT TO DO
Vvveb, a PHP content management system, has an incomplete fix for an earlier flaw, so editor or site admin accounts can still upload or rename template files to hold PHP code. An attacker with such an account can get PHP code to run on the server.
first public Oct 29, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted Vvveb CMS installs at version 1.0.8.6 or earlier that have users with the editor or site_admin role. Those users can upload or rename .tpl template files through the editor/code module and put PHP in them, which the server then runs. Installs with only full admin users, or where no one holds those roles, can skip it for now.
Not affected if no-editor-role-users, vvveb-1.0.8.7-or-later
Who cares authenticated, cms, php, self-hosted, vvveb
Vvveb through 1.0.8.6 contains an incomplete fix for CVE-2026-41934 that allows authenticated editor or site_admin users to write server-side templates by bypassing save restrictions. Attackers can upload or rename .tpl files via editor/code upload and rename actions, or evade isExecutableFile checks in save(), to inject PHP code into templates.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
1.0.8.6s suggested patch: add tplto MediaTrait::$uploadDenyExtensions, add<?=to $denySignatures, and check the incoming content for<?phpand<?=' in Code::save() before writing