CVE-2026-6249
Vvveb CMS 1.0.8.2 Remote Code Execution via Media Upload
Summary
Vvveb CMS 1.0.8.2 Remote Code Execution via Media Upload
Original description
The description as published by the source.
Vvveb CMS 1.0.8.2 contains a remote code execution vulnerability in its media upload handler that allows authenticated attackers to execute arbitrary operating system commands by uploading a PHP webshell with a .phtml extension. Attackers can bypass the extension deny-list and upload malicious files to the publicly accessible media directory, then request the file over HTTP to achieve full server compromise.
References
- advisory github.com
- advisory nvd.nist.gov
- advisory vulncheck.com
- patch github.com