Vvveb versions earlier than 1.0.8.2 contain an unrestricted file upload vulnerability in the media upload handler. Authenticated users with media‑upload privileges can bypass extension restrictions by uploading a .htaccess file that maps .phtml extensions to the PHP handler. The attacker can then upload a .phtml file with arbitrary PHP code and trigger execution via a subsequent unauthenticated HTTP GET request, resulting in remote code execution with web‑server privileges. The flaw is identified as a file‑upload bypass (CWE‑434).

The vulnerability affects the Vvveb CMS developed by givanz. Any installation on a server running Vvveb earlier than release 1.0.8.2 is susceptible.

The CVSS score of 8.7 indicates high severity, while the EPSS score of 0.0009 indicates a very low but non‑zero exploitation probability. The flaw is not listed in the CISA KEV catalog. Inference indicates that an attacker must first obtain authentication with media‑upload rights; however, once the malicious file is placed, a simple unauthenticated request can trigger execution, giving the attacker full web‑server code‑execution capabilities. The risk is therefore high for authenticated insiders or compromised accounts.