The flaw permits an authenticated user with editor, author, contributor, or site_admin privileges in Vvveb to execute arbitrary code. By crafting a malicious .htaccess file that maps a non‑PHP file extension to the PHP handler and then uploading PHP code with that extension, the attacker can trigger unauthenticated remote code execution when the file is accessed over HTTP. The weakness is classified under CWE-184, indicating insufficient file extension validation and control.

All instances of the Vvveb platform before version 1.0.8.2 are vulnerable. This includes installations packaged under the givanz:Vvveb vendor name and any custom deployments using the same code base.

The overall risk is high, reflected in a CVSS score of 8.7. Although no EPSS score is published and the vulnerability is not listed in the CISA KEV catalog, the attack requires only low‑privilege authenticated access. An attacker can easily exercise the editor function if they possess any of the roles mentioned, making the validation path widely available. Once the malicious code is uploaded, remote execution is achieved without additional privilege escalation, underscoring the critical nature of the vulnerability.