Vvveb versions older than 1.0.8.2 allow an authenticated user with media‑upload permission to upload a .htaccess file that redefines .phtml as a PHP handler. The attacker can then upload a .phtml file containing arbitrary PHP code and execute it through an unauthenticated HTTP GET request, achieving remote code execution with web‑server privileges. The flaw is a classic file‑upload bypass (CWE‑434).

The vulnerability affects the Vvveb CMS developed by givanz. Any installation on a server running Vvveb earlier than release 1.0.8.2 is susceptible.

The CVSS score of 8.7 indicates high severity, while the EPSS score is not available. The flaw is not listed in the CISA KEV catalog. Inference indicates that an attacker must first obtain authentication with media‑upload rights; however, once the malicious file is placed, a simple unauthenticated request can trigger execution, giving the attacker full web‑server code‑execution capabilities. The risk is therefore high for authenticated insiders or compromised accounts.