---
id: "CVE-2026-126372"
page: "https://infrastack.ai/live/CVE-2026-126372"
kind: "vulnerability"
aliases: ["CVE-2026-126372"]
title: "Vvveb CMS: editor users can inject PHP into templates"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Vvveb", "fixed": [], "affected": "<= 1.0.8.6", "ecosystem": "packagist"}]
ecosystems: []
tags: ["authenticated", "cms", "package", "php", "self-hosted", "vvveb"]
not_affected_if: ["no-editor-role-users", "vvveb-1.0.8.7-or-later"]
published_at: "2026-11-13T10:17:39+00:00"
first_seen_at: "2026-11-13T10:47:17+00:00"
updated_at: "2026-11-13T10:52:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126372", "first_seen_at": "2026-11-13T10:47:17+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-13T10:52:07+00:00"}]
exploit_sources: []
---

# Vvveb CMS: editor users can inject PHP into templates

Link for people: https://infrastack.ai/live/CVE-2026-126372 (this .md is for agents)

Vvveb, a PHP content management system, has an incomplete fix for an earlier flaw, so editor or site admin accounts can still upload or rename template files to hold PHP code. An attacker with such an account can get PHP code to run on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- packagist:Vvveb affected <= 1.0.8.6 fixed no fixed version listed

## How to check

- Run Vvveb <= 1.0.8.6? You are affected; no fixed release exists yet.
- In the admin, list users with the editor or site_admin role; those accounts can use editor/code upload and rename to write .tpl files.
- In system/traits/media.php, check whether $uploadDenyExtensions includes 'tpl'; if not, the bypass is open.
- Look for .tpl files under the themes, plugins or public dirs that contain '<?php' or '<?=' or were changed recently.

## Fix

No patched version: the maintainer advisory lists patched versions as None for <= 1.0.8.6. Maintainer's suggested patch: add 'tpl' to MediaTrait::$uploadDenyExtensions, add '<?=' to $denySignatures, and check the incoming content for '<?php' and '<?=' in Code::save() before writing. Until a release, restrict the editor and site_admin roles.

## Timeline

- 2026-11-13T10:47:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126372
- 2026-11-13T10:52:07+00:00 analyst — Maintainer GHSA-7h6v-ww3f-24pp (Oct 29 2026) says patched versions: None, affected <= 1.0.8.6; triage's 1.0.8.7 not-affected tag had no source and was dropped. No exploitation or PoC seen; did not search social.

## Documents

- [advisory] Vendor advisory: github.com https://github.com/givanz/Vvveb/security/advisories/GHSA-7h6v-ww3f-24pp
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/vvveb-through-1.0.8.6-template-upload-bypass-via-mediatrait-editor-code

## From the sources

Vvveb through 1.0.8.6 contains an incomplete fix for CVE-2026-41934 that allows authenticated editor or site_admin users to write server-side templates by bypassing save restrictions. Attackers can upload or rename .tpl files via editor/code upload and rename actions, or evade isExecutableFile checks in save(), to inject PHP code into templates.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_