CVE-2026-41936: Vvveb CMS XXE Injection Vulnerability

CVE-2026-41936 Overview

CVE-2026-41936 is an XML External Entity (XXE) injection vulnerability in Vvveb, an open-source content management system, affecting all versions before 1.0.8.2. The flaw resides in the admin Tools/Import feature, specifically in system/import/xml.php, where the XML parser is configured with LIBXML_NOENT and without LIBXML_NONET restrictions in a way that resolves external entities. Authenticated site_admin users can inject file:// or php://filter entity references that the parser resolves and persists into the application database. This enables arbitrary file disclosure and overwriting of administrator password hashes for privilege escalation. The vulnerability is tracked under [CWE-611] (Improper Restriction of XML External Entity Reference).

Critical Impact

Authenticated attackers with site_admin privileges can read arbitrary files from the server filesystem and overwrite administrator credentials, leading to full compromise of the Vvveb instance.

Affected Products

• Vvveb CMS versions prior to 1.0.8.2
• Deployments using the admin Tools/Import functionality
• Self-hosted Vvveb installations parsing untrusted XML import files

Discovery Timeline

• 2026-05-06 - CVE-2026-41936 published to NVD
• 2026-05-06 - Last updated in NVD database
• Patch Released - Vvveb 1.0.8.2 published on GitHub with hardened XML parser options

Technical Details for CVE-2026-41936

Vulnerability Analysis

The vulnerability stems from insecure libxml2 parser configuration in system/import/xml.php. The $importXMLOptions bitmask included LIBXML_NOENT, which substitutes XML entity references with their resolved content during parsing. Combined with LIBXML_PARSEHUGE and the absence of effective network restrictions, the parser dereferences attacker-controlled external entities embedded in import files.

When a site_admin uploads a crafted XML import containing a DOCTYPE declaration with an external entity, the parser resolves URIs such as file:///etc/passwd or php://filter/convert.base64-encode/resource=config.php. The resolved content replaces the entity reference and is then written into application database tables alongside the imported records. Attackers retrieve disclosed file content by reading the persisted records through the admin UI.

The same primitive enables credential overwrite: by directing entity-resolved data into rows mapped to the administrator user record, an attacker can replace the stored password hash, then authenticate with a known credential.

Root Cause

The root cause is the inclusion of LIBXML_NOENT in the libxml2 options used by loadXML. This flag instructs the parser to substitute entities, including external entities pointing at local files or PHP stream wrappers. The parser also lacked LIBXML_NONET enforcement consistent with safe defaults, allowing entity expansion against arbitrary URIs.

Attack Vector

Exploitation requires authenticated access as a site_admin. The attacker crafts an XML file containing a DOCTYPE with an external entity declaration referencing a target file path or PHP filter stream, then uploads it through the admin Tools/Import interface. The parser resolves the entity, and the resulting content is committed to database tables that the attacker can subsequently read or that map to privileged account fields.

// Patch in system/import/xml.php
// Source: https://github.com/givanz/Vvveb/commit/86f7128a18edebe0ff47e3855558467eb0ef9106
private $importXMLOptions = LIBXML_NOBLANKS |
    LIBXML_COMPACT |
    LIBXML_NOCDATA |
    LIBXML_PARSEHUGE |
    LIBXML_NOWARNING |
    LIBXML_BIGLINES;
// Removed: LIBXML_NOENT and LIBXML_NONET to disable external entity substitution

The fix removes LIBXML_NOENT, preventing libxml2 from substituting external entity references during XML import parsing.

Detection Methods for CVE-2026-41936

Indicators of Compromise

• XML import files in upload directories containing <!DOCTYPE declarations with <!ENTITY references to file:// or php://filter URIs
• Database rows in Vvveb content tables containing fragments of operating system files such as /etc/passwd, /etc/shadow, or PHP source code
• Unexpected modifications to administrator password hashes in the user table without corresponding password-change audit events
• Admin user accounts authenticating from new IP addresses shortly after an XML import event

Detection Strategies

• Inspect HTTP request bodies and uploaded files to the admin Tools/Import endpoint for DOCTYPE and ENTITY tokens combined with SYSTEM references
• Review web server access logs for POST requests to import endpoints performed by site_admin accounts followed by anomalous read activity
• Compare administrator password hash values against known-good baselines and alert on out-of-band changes

Monitoring Recommendations

• Log all admin Tools/Import activity including originating user, file name, and file size
• Enable PHP error logging for libxml warnings and entity resolution failures
• Monitor outbound network connections from the web server process to detect SSRF-style entity dereferences against internal services

How to Mitigate CVE-2026-41936

Immediate Actions Required

• Upgrade Vvveb to version 1.0.8.2 or later, which removes LIBXML_NOENT from the import parser configuration
• Audit administrator account password hashes and force credential rotation for all site_admin users
• Review the database for content rows containing filesystem paths or PHP source fragments that indicate prior exploitation

Patch Information

The patch is available in the GitHub commit 86f7128 and shipped in Vvveb release 1.0.8.2. Additional context is documented in the GitHub Security Advisory GHSA-rfxr-4xpm-wrp7 and the Vulncheck Advisory for Vvveb.

Workarounds

• Restrict access to the admin Tools/Import feature to a minimal set of trusted administrators until patching is complete
• Deploy a web application firewall rule that blocks XML uploads containing <!DOCTYPE and <!ENTITY declarations to admin import endpoints
• Run the PHP process under a least-privilege user account that cannot read sensitive configuration or credential files

# Upgrade to patched Vvveb release
git fetch --tags
git checkout 1.0.8.2

# Verify the patched parser options no longer include LIBXML_NOENT
grep -n 'LIBXML_NOENT\|LIBXML_NONET' system/import/xml.php
# Expected output: no matches