CVE-2026-6249
Vvveb CMS 1.0.8.2 Remote Code Execution via Media Upload
Résumé
Vvveb CMS 1.0.8.2 Remote Code Execution via Media Upload
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Vvveb CMS 1.0.8.2 contains a remote code execution vulnerability in its media upload handler that allows authenticated attackers to execute arbitrary operating system commands by uploading a PHP webshell with a .phtml extension. Attackers can bypass the extension deny-list and upload malicious files to the publicly accessible media directory, then request the file over HTTP to achieve full server compromise.
Références
- advisory github.com
- advisory nvd.nist.gov
- advisory vulncheck.com
- patch github.com