{"id":"CVE-2026-126378","kind":"vulnerability","aliases":["CVE-2026-126378"],"related":[],"title":"Vvveb: theme installer upload lets admins run PHP code on nginx","description":"Vvveb through 1.0.8.6 contains a file upload vulnerability in the theme installer validFile() function that uses strpos() instead of strict path matching. Attackers with admin credentials can upload a ZIP containing a PHP file whose path includes /theme.php to achieve remote code execution on nginx deployments.","summary":"Vvveb's theme installer validFile() uses strpos() to allow theme.php, so a ZIP entry like mytheme/scripts/theme.php passes the check and is extracted to public/themes/. With the bundled nginx-live.conf, which has no PHP deny rule for /themes/, an admin can then run it as a webshell. The advisory lists no patched version.","severity":"critical","cvss":9.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Vvveb","fixed":[],"affected":"<= 1.0.8.6","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cms","nginx","php","runtime","self-hosted","vvveb"],"not_affected_if":["apache","auth-required","no-admin-access","no-vvveb","php-denied-in-themes"],"how_to_check":"- Check the Vvveb version: <= 1.0.8.6 is affected, no fixed version exists yet.\n- Check system/extensions/themes.php (around line 195) for strpos($file, '/theme.php') === false.\n- Check whether your nginx config (e.g. the bundled nginx-live.conf) lacks a PHP deny rule for /themes/; look for files under public/themes/*/ other than the expected theme.php, e.g. nested scripts/theme.php.\n- Review who holds admin accounts; exploitation needs admin credentials.","fix":"No patched release listed in the GitHub advisory (patched versions: None). Interim, per the advisory: in system/extensions/themes.php validFile() reject all PHP files (if ($extension == 'php') return false;) and add to nginx config: location /themes { location ~ \\.php$ { deny all; } }","status":"open","published_at":"2026-11-13T10:17:40+00:00","first_seen_at":"2026-11-13T10:47:17+00:00","triaged_at":"2026-11-13T10:48:20+00:00","updated_at":"2026-11-13T10:48:54+00:00","category":"runtime","confidence":0.85,"triage":{"at":"2026-11-13T10:48:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Vvveb: theme installer upload lets admins run PHP code on nginx","impact":"high","summary":"Vvveb, a PHP content management system, checks uploaded theme ZIP files with a loose string match, so a crafted archive can slip a PHP file past the check. An attacker with admin credentials can use this to run code on the server when nginx serves the site.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["vvveb","php","nginx","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs PHP code on the server as admin","analyst_note":"Confirm the fixed version and vendor fix from the GitHub advisory (github.com) and the VulnCheck advisory, which are linked but not quoted here.","how_to_check":"- Find the Vvveb version in use and compare it with `1.0.8.6`, the last version the description names as affected.\n- Check whether the theme installer is reachable from the internet and whether nginx serves the Vvveb directory.\n- Review who holds admin accounts on the Vvveb instance.","plain_action":"","product_name":"Vvveb","needs_analyst":true,"not_affected_if":["no-vvveb","auth-required"],"who_is_affected":"Sites running Vvveb through 1.0.8.6 where the theme installer can be used, most clearly on nginx deployments. Exposure needs admin credentials, so instances with tight admin access and no theme installs are lower risk. Sites that do not run Vvveb can skip it.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000762,"input_tokens":4601,"output_tokens":603,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the fixed version and vendor fix from the GitHub advisory (github.com) and the VulnCheck advisory, which are linked but not quoted here.","search":"'-126378':14A,17A '-2026':13A,16A '/theme.php':115C '/themes':62B '1.0.8.6':80C 'achiev':117C 'admin':6A,64B,102C 'advisori':73B 'allow':35B 'attack':100C 'bundl':53B 'check':45B 'cms':19B 'code':9A,119C 'contain':81C,108C 'credenti':103C 'cve':12A,15A 'deni':59B 'deploy':123C 'entri':40B 'execut':120C 'extract':48B 'file':83C,111C 'function':91C 'host':25B 'includ':114C 'instal':3A,30B,89C 'instead':95C 'let':5A 'like':41B 'list':74B 'match':99C 'mytheme/scripts/theme.php':42B 'nginx':11A,20B,122C 'nginx-live.conf':54B 'pass':43B 'patch':76B 'path':98C,113C 'php':8A,21B,58B,110C 'public/themes':50B 'remot':118C 'rule':60B 'run':7A,67B 'runtim':22B 'self':24B 'self-host':23B 'strict':97C 'strpos':33B,94C 'theme':2A,29B,88C 'theme.php':36B 'upload':4A,84C,105C 'use':32B,93C 'validfil':31B,90C 'version':77B 'vulner':85C 'vvveb':1A,18A,26B,27B,78C 'webshel':71B 'whose':112C 'zip':39B,107C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Vvveb instances version 1.0.8.6 or earlier served by nginx with the bundled config, where /themes/ can execute PHP. The attacker needs admin credentials. Apache deployments are incidentally protected by public/themes/.htaccess, per the advisory.","tier":"B","verified":{"fix":{"at":"2026-11-13T10:48:54Z","by":"analyst","doc":"https://github.com/givanz/Vvveb/security/advisories/GHSA-xpgr-r6c8-3hpq","run_id":3849},"products":{"at":"2026-11-13T10:48:54Z","by":"analyst","doc":"https://github.com/givanz/Vvveb/security/advisories/GHSA-xpgr-r6c8-3hpq","run_id":3849},"how_to_check":{"at":"2026-11-13T10:48:54Z","by":"analyst","doc":"https://github.com/givanz/Vvveb/security/advisories/GHSA-xpgr-r6c8-3hpq","run_id":3849},"who_affected":{"at":"2026-11-13T10:48:54Z","by":"analyst","doc":"https://github.com/givanz/Vvveb/security/advisories/GHSA-xpgr-r6c8-3hpq","run_id":3849}},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["vvveb"],"ptokens":["vvveb"],"labels":["cms","critical","nginx","php","runtime","selfhosted","vendor","vvveb"],"campaign_type":null,"search_a":"'-126378':14A,17A '-2026':13A,16A 'admin':6A 'code':9A 'cve':12A,15A 'instal':3A 'let':5A 'nginx':11A 'php':8A 'run':7A 'theme':2A 'upload':4A 'vvveb':1A,18A","search_b":"'/themes':62B 'admin':64B 'advisori':73B 'allow':35B 'bundl':53B 'check':45B 'cms':19B 'deni':59B 'entri':40B 'extract':48B 'host':25B 'instal':30B 'like':41B 'list':74B 'mytheme/scripts/theme.php':42B 'nginx':20B 'nginx-live.conf':54B 'pass':43B 'patch':76B 'php':21B,58B 'public/themes':50B 'rule':60B 'run':67B 'runtim':22B 'self':24B 'self-host':23B 'strpos':33B 'theme':29B 'theme.php':36B 'use':32B 'validfil':31B 'version':77B 'vvveb':26B,27B 'webshel':71B 'zip':39B","search_c":"'/theme.php':115C '1.0.8.6':80C 'achiev':117C 'admin':102C 'attack':100C 'code':119C 'contain':81C,108C 'credenti':103C 'deploy':123C 'execut':120C 'file':83C,111C 'function':91C 'includ':114C 'instal':89C 'instead':95C 'match':99C 'nginx':122C 'path':98C,113C 'php':110C 'remot':118C 'strict':97C 'strpos':94C 'theme':88C 'upload':84C,105C 'use':93C 'validfil':90C 'vulner':85C 'vvveb':78C 'whose':112C 'zip':107C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-29T01:14:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126378","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126378","severity":null,"published_at":"2026-11-13T10:17:40+00:00","modified_at":"2026-11-13T10:17:40+00:00","first_seen_at":"2026-11-13T10:47:17+00:00","fetched_at":"2026-11-13T10:47:17+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126378:3849","url":null,"severity":null,"published_at":"2026-11-13T10:48:54+00:00","modified_at":"2026-11-13T10:48:54+00:00","first_seen_at":"2026-11-13T10:48:54+00:00","fetched_at":"2026-11-13T10:48:54+00:00","note":"Read GHSA and VulnCheck advisories: <=1.0.8.6 affected, GHSA lists patched versions None; no exploitation reported; PoC is in the advisory."}],"documents":[{"id":144997,"url":"https://github.com/givanz/Vvveb/security/advisories/GHSA-xpgr-r6c8-3hpq","title":"GHSA-xpgr-r6c8-3hpq Vvveb theme installer validFile() bypass","kind":"advisory","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-29T01:14:51+00:00","relation":"advisory","confidence":null,"note":null},{"id":144998,"url":"https://www.vulncheck.com/advisories/vvveb-through-1.0.8.6-webshell-upload-via-theme-installer-validfile-bypass","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}