{"id":"CVE-2026-126372","kind":"vulnerability","aliases":["CVE-2026-126372"],"related":[],"title":"Vvveb CMS: editor users can inject PHP into templates","description":"Vvveb through 1.0.8.6 contains an incomplete fix for CVE-2026-41934 that allows authenticated editor or site_admin users to write server-side templates by bypassing save restrictions. Attackers can upload or rename .tpl files via editor/code upload and rename actions, or evade isExecutableFile checks in save(), to inject PHP code into templates.","summary":"Vvveb, a PHP content management system, has an incomplete fix for an earlier flaw, so editor or site admin accounts can still upload or rename template files to hold PHP code. An attacker with such an account can get PHP code to run on the server.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Vvveb","fixed":[],"affected":"<= 1.0.8.6","ecosystem":"packagist"}],"ecosystems":[],"tags":["authenticated","cms","package","php","self-hosted","vvveb"],"not_affected_if":["no-editor-role-users","vvveb-1.0.8.7-or-later"],"how_to_check":"- Run Vvveb <= 1.0.8.6? You are affected; no fixed release exists yet.\n- In the admin, list users with the editor or site_admin role; those accounts can use editor/code upload and rename to write .tpl files.\n- In system/traits/media.php, check whether $uploadDenyExtensions includes 'tpl'; if not, the bypass is open.\n- Look for .tpl files under the themes, plugins or public dirs that contain '<?php' or '<?=' or were changed recently.","fix":"No patched version: the maintainer advisory lists patched versions as None for <= 1.0.8.6. Maintainer's suggested patch: add 'tpl' to MediaTrait::$uploadDenyExtensions, add '<?=' to $denySignatures, and check the incoming content for '<?php' and '<?=' in Code::save() before writing. Until a release, restrict the editor and site_admin roles.","status":"open","published_at":"2026-11-13T10:17:39+00:00","first_seen_at":"2026-11-13T10:47:17+00:00","triaged_at":"2026-11-13T10:48:57+00:00","updated_at":"2026-11-13T10:52:07+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-13T10:48:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Vvveb CMS: editor users can inject PHP into templates","impact":"high","summary":"Vvveb, a PHP content management system, has an incomplete fix for an earlier flaw, so editor or site admin accounts can still upload or rename template files to hold PHP code. An attacker with such an account can get PHP code to run on the server.","audience":"businesses","category":"package","nicknames":[],"who_cares":["vvveb","php","cms","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"PHP code runs on the server through a template","analyst_note":"Confirm the fixed Vvveb version and whether the vendor advisory on github.com names it; the sources give no fixed version.","how_to_check":"- Check the installed Vvveb version against the fixed release, which the sources do not name.\n- Review who holds editor or site_admin accounts in the Vvveb admin.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-editor-role-users","vvveb-1.0.8.7-or-later"],"who_is_affected":"Sites running Vvveb through 1.0.8.6 where users other than full admins can edit code or templates. Installs that restrict editor and site_admin roles or do not use Vvveb's code editor are less exposed. The sources do not say more.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000721,"input_tokens":4627,"output_tokens":516,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed Vvveb version and whether the vendor advisory on github.com names it; the sources give no fixed version.","search":"'-126372':12A,15A '-2026':11A,14A,80C '-41934':81C '1.0.8.6':73C 'account':44B,61B 'action':112C 'admin':43B,88C 'allow':83C 'attack':57B,100C 'authent':17B,84C 'bypass':97C 'check':116C 'cms':2A,18B 'code':55B,65B,122C 'contain':74C 'content':28B 'cve':10A,13A,79C 'earlier':37B 'editor':3A,40B,85C 'editor/code':108C 'evad':114C 'file':51B,106C 'fix':34B,77C 'flaw':38B 'get':63B 'hold':53B 'host':23B 'incomplet':33B,76C 'inject':6A,120C 'isexecutablefil':115C 'manag':29B 'packag':19B 'php':7A,20B,27B,54B,64B,121C 'renam':49B,104C,111C 'restrict':99C 'run':67B 'save':98C,118C 'self':22B 'self-host':21B 'server':70B,93C 'server-sid':92C 'side':94C 'site':42B,87C 'still':46B 'system':30B 'templat':9A,50B,95C,124C 'tpl':105C 'upload':47B,102C,109C 'user':4A,89C 'via':107C 'vvveb':1A,16A,24B,25B,71C 'write':91C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Vvveb CMS installs at version 1.0.8.6 or earlier that have users with the editor or site_admin role. Those users can upload or rename .tpl template files through the editor/code module and put PHP in them, which the server then runs. Installs with only full admin users, or where no one holds those roles, can skip it for now.","tier":"B","verified":{"fix":{"at":"2026-11-13T10:52:07Z","by":"analyst","doc":"https://github.com/givanz/Vvveb/security/advisories/GHSA-7h6v-ww3f-24pp","run_id":3861},"products":{"at":"2026-11-13T10:52:07Z","by":"analyst","doc":"https://github.com/givanz/Vvveb/security/advisories/GHSA-7h6v-ww3f-24pp","run_id":3861},"how_to_check":{"at":"2026-11-13T10:52:07Z","by":"analyst","doc":"https://github.com/givanz/Vvveb/security/advisories/GHSA-7h6v-ww3f-24pp","run_id":3861},"who_affected":{"at":"2026-11-13T10:52:07Z","by":"analyst","doc":"https://github.com/givanz/Vvveb/security/advisories/GHSA-7h6v-ww3f-24pp","run_id":3861}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["vvveb"],"ptokens":["vvveb"],"labels":["authenticated","cms","high","package","php","selfhosted","vvveb"],"campaign_type":null,"search_a":"'-126372':12A,15A '-2026':11A,14A 'cms':2A 'cve':10A,13A 'editor':3A 'inject':6A 'php':7A 'templat':9A 'user':4A 'vvveb':1A,16A","search_b":"'account':44B,61B 'admin':43B 'attack':57B 'authent':17B 'cms':18B 'code':55B,65B 'content':28B 'earlier':37B 'editor':40B 'file':51B 'fix':34B 'flaw':38B 'get':63B 'hold':53B 'host':23B 'incomplet':33B 'manag':29B 'packag':19B 'php':20B,27B,54B,64B 'renam':49B 'run':67B 'self':22B 'self-host':21B 'server':70B 'site':42B 'still':46B 'system':30B 'templat':50B 'upload':47B 'vvveb':24B,25B","search_c":"'-2026':80C '-41934':81C '1.0.8.6':73C 'action':112C 'admin':88C 'allow':83C 'attack':100C 'authent':84C 'bypass':97C 'check':116C 'code':122C 'contain':74C 'cve':79C 'editor':85C 'editor/code':108C 'evad':114C 'file':106C 'fix':77C 'incomplet':76C 'inject':120C 'isexecutablefil':115C 'php':121C 'renam':104C,111C 'restrict':99C 'save':98C,118C 'server':93C 'server-sid':92C 'side':94C 'site':87C 'templat':95C,124C 'tpl':105C 'upload':102C,109C 'user':89C 'via':107C 'vvveb':71C 'write':91C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-29T01:15:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126372","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126372","severity":null,"published_at":"2026-11-13T10:17:39+00:00","modified_at":"2026-11-13T10:17:39+00:00","first_seen_at":"2026-11-13T10:47:17+00:00","fetched_at":"2026-11-13T10:47:17+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126372:3861","url":null,"severity":null,"published_at":"2026-11-13T10:52:07+00:00","modified_at":"2026-11-13T10:52:07+00:00","first_seen_at":"2026-11-13T10:52:07+00:00","fetched_at":"2026-11-13T10:52:07+00:00","note":"Maintainer GHSA-7h6v-ww3f-24pp (Oct 29 2026) says patched versions: None, affected <= 1.0.8.6; triage's 1.0.8.7 not-affected tag had no source and was dropped. No exploitation or PoC seen; did not search social."}],"documents":[{"id":144985,"url":"https://github.com/givanz/Vvveb/security/advisories/GHSA-7h6v-ww3f-24pp","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-29T01:15:57+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144986,"url":"https://www.vulncheck.com/advisories/vvveb-through-1.0.8.6-template-upload-bypass-via-mediatrait-editor-code","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}