Technical impact
The vulnerability permits low‑privilege authenticated users in Vvveb with editor, author, contributor, or site_admin roles to execute arbitrary code. By creating a malicious .htaccess file that maps an arbitrary file extension to the PHP handler and then uploading PHP code using that extension, the attacker can trigger unauthenticated remote code execution when the file is accessed through HTTP. The flaw is classified under CWE‑184 due to insufficient file extension validation.
Affected Systems
All instances of the Vvveb platform before version 1.0.8.2 are vulnerable. This includes installations packaged under the givanz:Vvveb vendor name and any custom deployments using the same code base.
Risk and Exploitability
The overall risk is high, reflected in a CVSS score of 8.7. The EPSS score is 0.00423, indicating a very low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, but the attack requires only low‑privilege authenticated access. An attacker can easily exercise the editor function if they possess any of the roles mentioned, making the validation path widely available. Once the malicious code is uploaded, remote execution is achieved without additional privilege escalation, underscoring the critical nature of the vulnerability.
