CVE-2026-41937

High

Description

Vvveb before 1.0.8.3 contains an unrestricted file upload vulnerability in the plugin upload endpoint that allows super_admin users to execute arbitrary PHP code by uploading a malicious plugin ZIP file. Attackers can craft a ZIP containing a plugin.php with a valid Slug header and a public/index.php file with arbitrary PHP code, which executes as the web server user once accessed via subsequent unauthenticated HTTP requests to the plugin's public path.

SeverityHigh

CVSS7.2

Exploit probability35. percentile0.4%

ProductVvveb

PublishedMay 14, 2026

First seenMay 14, 2026

Weakness typeCWE-434Unrestricted upload of dangerous file type CWE-61CWE-61

How to fix

Update

givanz Vvveb1.0.8.3 or later

Patches

github.com/givanz/Vvveb/commit/04f0294350ec429e307cd31c2e777a4797c868d6

Vendor advisories

github.com/givanz/Vvveb/releases/tag/1.0.8.3

Affected products

Product	Affected versions	Fixed in
givanz Vvveb	v < 1.0.8.3	1.0.8.3

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.