CVE-2026-6249
Vvveb CMS 1.0.8.2 Remote Code Execution via Media Upload
概要
Vvveb CMS 1.0.8.2 Remote Code Execution via Media Upload
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Vvveb CMS 1.0.8.2 contains a remote code execution vulnerability in its media upload handler that allows authenticated attackers to execute arbitrary operating system commands by uploading a PHP webshell with a .phtml extension. Attackers can bypass the extension deny-list and upload malicious files to the publicly accessible media directory, then request the file over HTTP to achieve full server compromise.
参照URL
- advisory github.com
- advisory nvd.nist.gov
- advisory vulncheck.com
- patch github.com