Description
Vvveb through 1.0.8.6 contains an incomplete fix for CVE-2026-41934 that allows authenticated editor or site_admin users to write server-side templates by bypassing save restrictions. Attackers can upload or rename .tpl files via editor/code upload and rename actions, or evade isExecutableFile checks in save(), to inject PHP code into templates.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| givanz | Vvveb | ≤ 1.0.8.6 | — |
References
- GitHub Security Advisory (GHSA-7h6v-ww3f-24pp) vendor-advisory
- VulnCheck Advisory: Vvveb through 1.0.8.6 Template Upload Bypass via MediaTrait editor/code third-party-advisory