VVVEB · CVE-2026-126378 · Runtime
NO FIX YET · SEE WHAT TO DO
Vvveb's theme installer validFile() uses strpos() to allow theme.php, so a ZIP entry like mytheme/scripts/theme.php passes the check and is extracted to public/themes/. With the bundled nginx-live.conf, which has no PHP deny rule for /themes/, an admin can then run it as a webshell. The advisory lists no patched version.
first public Oct 29, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted Vvveb instances version 1.0.8.6 or earlier served by nginx with the bundled config, where /themes/ can execute PHP. The attacker needs admin credentials. Apache deployments are incidentally protected by public/themes/.htaccess, per the advisory.
Not affected if apache, auth-required, no-admin-access, no-vvveb, php-denied-in-themes
Who cares cms, nginx, php, self-hosted, vvveb
Vvveb through 1.0.8.6 contains a file upload vulnerability in the theme installer validFile() function that uses strpos() instead of strict path matching. Attackers with admin credentials can upload a ZIP containing a PHP file whose path includes /theme.php to achieve remote code execution on nginx deployments.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
php) return false;) and add to nginx config: location /themes { location ~ .php$ { deny all; } }