CVE-2026-41938: Vvveb File Upload RCE Vulnerability

CVE-2026-41938 Overview

CVE-2026-41938 is an unrestricted file upload vulnerability in Vvveb content management system versions before 1.0.8.2. The flaw resides in the media upload handler and allows authenticated users with media-upload permissions to bypass extension filtering. Attackers upload a .htaccess file that maps the .phtml extension to the PHP handler, then upload a .phtml file containing arbitrary PHP code. An unauthenticated HTTP GET request to the uploaded file triggers code execution under the web server account. The weakness is classified as [CWE-434] Unrestricted Upload of File with Dangerous Type.

Critical Impact

Authenticated attackers gain remote code execution on the host with web server privileges, enabling full application compromise and lateral movement.

Affected Products

• Vvveb CMS versions prior to 1.0.8.2
• Deployments running on Apache web servers honoring .htaccess overrides
• Any Vvveb instance granting media-upload permissions to non-administrative roles

Discovery Timeline

• 2026-05-06 - CVE-2026-41938 published to NVD
• 2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-41938

Vulnerability Analysis

The Vvveb media upload handler enforces an extension blocklist on uploaded filenames but does not validate .htaccess files or restrict server-side execution mappings. An authenticated user with the media-upload role can place a crafted .htaccess directive into the uploads directory. The directive instructs Apache to treat .phtml files as PHP source. The attacker then uploads a second file with the .phtml suffix containing PHP payloads. Because the uploads directory is web-accessible, an unauthenticated HTTP GET request to the .phtml file executes the embedded code. The result is remote code execution (RCE) running with the privileges of the web server process.

Root Cause

The upload handler relies on extension-based filtering instead of content inspection or a strict allowlist. It also fails to deny .htaccess files in the upload directory. Apache configurations that permit AllowOverride FileInfo then honor attacker-supplied handler mappings, breaking the security boundary between uploaded data and executable code.

Attack Vector

The attacker authenticates with any account that has media-upload permission. They submit a .htaccess file via the media upload endpoint containing an AddType application/x-httpd-php .phtml or AddHandler directive. They then upload a .phtml file containing PHP code. Finally, the attacker issues an unauthenticated HTTP GET to the uploaded file URL, triggering execution. No user interaction is required after upload.

// Patch reference from the 1.0.8.2 release commit (system/core/view.php)
// Adds an admin session check to component rendering paths.
if ($admin = \Vvveb\System\User\Admin :: current()) {
    $this->component        = \Vvveb\filter('/[a-z\-]+/', $_REQUEST['_component_ajax'], 80);
    $this->componentCount   = \Vvveb\filter('/\d+/', $_REQUEST['_component_id'] ?? 0, 4);
    $this->componentContent = $_POST['_component_content'] ?? '';
    $this->html             = $_POST['html'] ?? '';
} else {
    die('Invalid request!');
}
// Source: https://github.com/givanz/Vvveb/commit/54a9e846fb94192f1b31ae81d81d25c874662e6a

Detection Methods for CVE-2026-41938

Indicators of Compromise

• Presence of .htaccess files inside the Vvveb media or uploads directory containing AddType, AddHandler, or SetHandler directives.
• Files with .phtml, .phar, or other unusual PHP-mapped extensions in user-writable upload paths.
• Web server access logs showing unauthenticated GET requests to files under the uploads directory followed by outbound connections from the PHP worker.

Detection Strategies

• Monitor file integrity on the Vvveb uploads directory and alert on any .htaccess write event.
• Inspect upload payloads at the web application firewall layer for AddHandler or application/x-httpd-php strings.
• Hunt PHP process trees that spawn shells, curl, wget, or reverse-shell binaries originating from the web server user.

Monitoring Recommendations

• Enable verbose Apache logging for the uploads virtual directory and forward logs to a centralized analytics platform.
• Track HTTP 200 responses for files served from /media/ or upload paths with extensions other than common image and document types.
• Correlate authenticated upload events in Vvveb application logs with subsequent unauthenticated requests to newly created files.

How to Mitigate CVE-2026-41938

Immediate Actions Required

• Upgrade Vvveb to version 1.0.8.2 or later, which is the fixed release published by the project maintainers.
• Audit the uploads directory for unauthorized .htaccess files and remove any non-image or non-document content uploaded by media-permission accounts.
• Rotate credentials for any account with media-upload privilege and review session activity for suspicious uploads.

Patch Information

The project published the fix in GitHub Release 1.0.8.2. Additional context is available in the GitHub Security Advisory GHSA-wwmv-4g9g-p48g and the VulnCheck RCE Advisory. The corresponding code change is in the GitHub Commit Update.

Workarounds

• Set Apache AllowOverride None for the document root and uploads directory so attacker-supplied .htaccess files are ignored.
• Add an explicit deny rule preventing execution of any file under the uploads path, for example using <FilesMatch> to block .php, .phtml, and .phar handlers.
• Restrict media-upload permissions to trusted administrative accounts until the patched version is deployed.

# Apache configuration to neutralize attacker-supplied handler mappings
<Directory "/var/www/vvveb/public/media">
    AllowOverride None
    php_flag engine off
    <FilesMatch "\.(php|phtml|phar|phps|pht)$">
        Require all denied
    </FilesMatch>
</Directory>