Vvveb CMS 1.0.8 includes a remote code execution vulnerability in its media upload handler that permits an authenticated attacker to upload a PHP webshell with a .phtml extension by bypassing the extension deny‑list. By placing the malicious file in the publicly accessible media directory and invoking it over HTTP, the attacker can execute arbitrary operating system commands and achieve full server compromise.

The affected product is Vvveb CMS 1.0.8. No other versions or variants are listed; the vulnerability specifically applies to this release.

The CVSS score of 8.7 classifies the flaw as high severity, while the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. Because the attack requires authentication to upload a file, an adversary must first gain valid credentials or otherwise bypass authentication before exploiting the flaw. Once authenticated, the attack path is straightforward: upload a PHP webshell disguised as .phtml, bypass the deny‑list, store the file in the media directory, and then retrieve it via an HTTP request to trigger command execution.