Vvveb CMS prior to v1.0.8.2 contains a remote code execution vulnerability in its media management functionality where a missing return statement in the file rename handler allows authenticated attackers to rename files to blocked extensions such as .php or .htaccess. Attackers can exploit this logic flaw by first uploading a text file and renaming it to .htaccess to inject Apache directives that register PHP‑executable MIME types, then uploading another file and renaming it to .php to execute arbitrary operating system commands as the www-data user. This results in full remote code execution on the web server, compromising the confidentiality, integrity, and availability of the site.

The vulnerability is present in all releases of Vvveb CMS prior to version 1.0.8.2. The affected system is the web server running Vvveb CMS where authenticated users can access the media manager function. This includes deployments running version 1.0.8 and earlier, which are still vulnerable if the latest patch is not applied.

The CVSS score is 9.2, indicating a very high risk. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. This vulnerability exists in Vvveb CMS versions prior to 1.0.8.2. Attackers must first authenticate to the CMS, typically as a site administrator or other privileged user, to access the media manager and rename files. Once authenticated, the attacker can immediately trigger the flaw and gain remote code execution on the web server. The lack of early detection means that this vulnerability could be exploited at any time until it is remediated.