Description
Vvveb before 1.0.9.0 contains a denylist bypass in system/traits/media.php where '.phar' is misconfigured with a leading dot, allowing authenticated administrators to upload .phar PHP files. Attackers can upload a GIF magic-byte polyglot webshell bypassing binary inspection and execute arbitrary OS commands as the web-server user.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| givanz | Vvveb | < 1.0.9.0 | 1.0.9.0 |
References
- GitHub Security Advisory (GHSA-hcpj-pcpx-2744) vendor-advisory
- Patch Commit patch
- VulnCheck Advisory: Vvveb before 1.0.9.0 RCE via .phar Extension Denylist Bypass in Media Upload third-party-advisory