VVVEB · CVE-2026-126380 · Other
NO FIX YET · SEE WHAT TO DO
Vvveb before 1.0.9.0 has a misconfigured denylist in its media upload code, so '.phar' PHP files are accepted. An attacker who holds an administrator account can upload a disguised .phar webshell and run operating system commands as the web server user.
first public Oct 29, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running Vvveb before 1.0.9.0 where administrator accounts can upload media. The flaw sits in the media upload denylist, so exposure depends on who holds admin rights; installations without untrusted admin users are at lower risk but should still upgrade.
Not affected if managed-hosting, version-1.0.9.0-or-later
Who cares cms, php, self-hosted, vvveb
1.0.9.0system/traits/media.php for the '.phar' entry in the upload denylist, which the sources say has a leading dot1.0.9.0 or laterVvveb before 1.0.9.0 contains a denylist bypass in system/traits/media.php where '.phar' is misconfigured with a leading dot, allowing authenticated administrators to upload .phar PHP files. Attackers can upload a GIF magic-byte polyglot webshell bypassing binary inspection and execute arbitrary OS commands as the web-server user.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.