CVE-2026-6257

Vvveb CMS < v1.0.8.2 Remote Code Execution via Media Management

Published Apr 20, 2026 CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Description

Vvveb CMS before 1.0.8.2 contains a remote code execution vulnerability in its media management functionality where a missing return statement in the file rename handler allows authenticated attackers to rename files to blocked extensions .php or .htaccess. Attackers can exploit this logic flaw by first uploading a text file and renaming it to .htaccess to inject Apache directives that register PHP-executable MIME types, then uploading another file and renaming it to .php to execute arbitrary operating system commands as the www-data user.

Analysis

Technical impact

Vvveb CMS before version 1.0.8.2 contains a remote code execution vulnerability in its media management functionality. A missing return statement in the file‑rename handler lets authenticated attackers rename files to blocked extensions such as .php or .htaccess. By uploading a plain text file and renaming it to .htaccess, attackers can inject Apache directives that register PHP‑executable MIME types; subsequently renaming another file to .php allows execution of arbitrary operating‑system commands as the www‑data user. This results in full remote code execution on the web server, compromising the confidentiality, integrity, and availability of the site.

Affected Systems

The vulnerability is present in Vvveb CMS releases up to and including version 1.0.8.2. The affected system is the web server running Vvveb CMS where authenticated users can access the media manager function. This includes deployments running version 1.0.8.2 or earlier, which are still vulnerable if the latest patch is not applied.

Risk and Exploitability

The CVSS score is 9.2, indicating a very high risk. The EPSS score is < 1 %, and the vulnerability is not listed in the CISA KEV catalog. This vulnerability exists in Vvveb CMS releases before version 1.0.8.2. Attackers must first authenticate to the CMS, typically as a site administrator or other privileged user, to access the media manager and rename files. Once authenticated, the attacker can immediately trigger the flaw and gain remote code execution on the web server. The lack of early detection means that this vulnerability could be exploited at any time until it is remediated.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Vvveb

Vvveb CMS

unaffected

Version	Status	Constraints
`0`	affected	< 1.0.8.2
`1.0.8.2`	unaffected	—

No data.

Vendor Product Versions

Vvveb

Version	Status	Scheme	Platform
`1.0.8`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Vvveb CMS to a newer release that fixes the rename handler bug.
Disable the media manager feature for all users except administrators.
Enforce a strict file extension whitelist that blocks ".php", ".htaccess", and other executable extensions.
Monitor server logs for unauthorized file renames or the presence of unexpected ".htaccess" files and react promptly.

Generated by OpenCVE AI on October 29, 2026 at 23:10 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact High

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.633% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/givanz/Vvveb/commit/6fb8eaa998265e33e8802cbc220d8859dbc144f2
https://www.vulncheck.com/advisories/vvveb-cms-remote-code-execution-via-media-management

History

Oct 29, 2026 8:30 PM Description updated. Affected versions updated View changes

Type	Values Removed	Values Added
Description	Vvveb CMS v1.0.8.2 contains a remote code execution vulnerability in its media management functionality where a missing return statement in the file rename handler allows authenticated attackers to rename files to blocked extensions .php or .htaccess. Attackers can exploit this logic flaw by first uploading a text file and renaming it to .htaccess to inject Apache directives that register PHP-executable MIME types, then uploading another file and renaming it to .php to execute arbitrary operating system commands as the www-data user.	Vvveb CMS before 1.0.8.2 contains a remote code execution vulnerability in its media management functionality where a missing return statement in the file rename handler allows authenticated attackers to rename files to blocked extensions .php or .htaccess. Attackers can exploit this logic flaw by first uploading a text file and renaming it to .htaccess to inject Apache directives that register PHP-executable MIME types, then uploading another file and renaming it to .php to execute arbitrary operating system commands as the www-data user.
CPEs	cpe:2.3:a:vvveb:vvveb:1.0.8.2:::::::*	cpe:2.3:a:vvveb:vvveb::::::::

Jul 14, 2026 10:30 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:vvveb:vvveb:1.0.8.2:::::::*

May 26, 2026 12:00 AM Description updated View changes

Type	Values Removed	Values Added
Description	Vvveb CMS prior to v1.0.8.2 contains a remote code execution vulnerability in its media management functionality where a missing return statement in the file rename handler allows authenticated attackers to rename files to blocked extensions .php or .htaccess. Attackers can exploit this logic flaw by first uploading a text file and renaming it to .htaccess to inject Apache directives that register PHP-executable MIME types, then uploading another file and renaming it to .php to execute arbitrary operating system commands as the www-data user.	Vvveb CMS v1.0.8.2 contains a remote code execution vulnerability in its media management functionality where a missing return statement in the file rename handler allows authenticated attackers to rename files to blocked extensions .php or .htaccess. Attackers can exploit this logic flaw by first uploading a text file and renaming it to .htaccess to inject Apache directives that register PHP-executable MIME types, then uploading another file and renaming it to .php to execute arbitrary operating system commands as the www-data user.

May 6, 2026 9:45 PM Description updated. Title updated View changes

Type	Values Removed	Values Added
Description	Vvveb CMS v1.0.8 contains a remote code execution vulnerability in its media management functionality where a missing return statement in the file rename handler allows authenticated attackers to rename files to blocked extensions .php or .htaccess. Attackers can exploit this logic flaw by first uploading a text file and renaming it to .htaccess to inject Apache directives that register PHP-executable MIME types, then uploading another file and renaming it to .php to execute arbitrary operating system commands as the www-data user.	Vvveb CMS prior to v1.0.8.2 contains a remote code execution vulnerability in its media management functionality where a missing return statement in the file rename handler allows authenticated attackers to rename files to blocked extensions .php or .htaccess. Attackers can exploit this logic flaw by first uploading a text file and renaming it to .htaccess to inject Apache directives that register PHP-executable MIME types, then uploading another file and renaming it to .php to execute arbitrary operating system commands as the www-data user.
Title	Vvveb CMS v1.0.8 Remote Code Execution via Media Management	Vvveb CMS < v1.0.8.2 Remote Code Execution via Media Management

Apr 22, 2026 12:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Vvveb Vvveb vvveb
Vendors & Products		Vvveb Vvveb vvveb

Apr 22, 2026 12:00 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Apr 20, 2026 7:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Vvveb CMS v1.0.8 contains a remote code execution vulnerability in its media management functionality where a missing return statement in the file rename handler allows authenticated attackers to rename files to blocked extensions .php or .htaccess. Attackers can exploit this logic flaw by first uploading a text file and renaming it to .htaccess to inject Apache directives that register PHP-executable MIME types, then uploading another file and renaming it to .php to execute arbitrary operating system commands as the www-data user.
Title		Vvveb CMS v1.0.8 Remote Code Execution via Media Management
Weaknesses		CWE-434
References		https://github.com/givanz/Vvveb/commit/6fb8eaa998265e33e8802cbc220d8859dbc144f2 https://www.vulncheck.com/advisories/vvveb-cms-remote-code-execution-via-media-management
Metrics		cvssV3_1 `{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H'}` cvssV4_0 `{'score': 9.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:H/SA:N'}`