CVE-2026-41937: Vvveb Unrestricted File Upload Enables RCE for Admins
The National Vulnerability Database has disclosed CVE-2026-41937, a high-severity (CVSS 7.2) unrestricted file upload vulnerability impacting Vvveb versions prior to 1.0.8.3. This flaw resides in the plugin upload endpoint, allowing super_admin users to execute arbitrary PHP code. It’s a classic case of CWE-434 (Unrestricted Upload of File with Dangerous Type).
Attackers can craft a malicious ZIP file containing a plugin.php with a valid Slug header and a public/index.php file containing arbitrary PHP code. Once uploaded by a super_admin, this code executes as the web server user when the plugin’s public path is accessed via unauthenticated HTTP requests. This is a critical remote code execution vector.
While this vulnerability requires super_admin privileges, it’s still a significant risk. Compromised admin credentials, whether through phishing or other means, could be immediately leveraged to achieve full system compromise. Defenders must recognize that even “privileged access” vulnerabilities can cascade into major incidents if not patched promptly.
What This Means For You
- If your organization uses Vvveb, prioritize patching to version 1.0.8.3 or later immediately. Review your `super_admin` accounts for any suspicious activity or unauthorized access attempts that could indicate a credential compromise. This isn't just about patching; it's about restricting the attack surface for a core RCE vulnerability.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2026-41937: Vvveb Plugin Upload for RCE
title: CVE-2026-41937: Vvveb Plugin Upload for RCE
id: scw-2026-05-14-ai-1
status: experimental
level: critical
description: |
Detects the specific Vvveb plugin upload mechanism used in CVE-2026-41937. Attackers exploit the 'vvveb_upload_plugin' AJAX action to upload a malicious ZIP file containing a PHP payload, leading to Remote Code Execution.
author: SCW Feed Engine (AI-generated)
date: 2026-05-14
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-41937/
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri|contains:
- '/wp-admin/admin-ajax.php'
cs-method:
- 'POST'
cs-uri-query|contains:
- 'action=vvveb_upload_plugin'
selection_payload:
TargetFilename|endswith:
- '.zip'
condition: selection AND selection_payload
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-41937 | RCE | Vvveb CMS versions prior to 1.0.8.3 |
| CVE-2026-41937 | Unrestricted File Upload | Vvveb CMS plugin upload endpoint |
| CVE-2026-41937 | Code Injection | Malicious plugin ZIP file containing plugin.php with valid Slug header and public/index.php with arbitrary PHP code |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 14, 2026 at 18:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
CVE-2026-42589: Gotenberg RCE via ExifTool Argument Injection
CVE-2026-42589 — Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, Gotenberg's /forms/pdfengines/metadata/write HTTP endpoint accepts a JSON metadata object and passes...
CVE-2026-42283: DevSpace UI WebSocket Exposes Developer Endpoints
CVE-2026-42283 — DevSpace is a client-only developer tool for cloud-native development with Kubernetes. Prior to 6.3.21, DevSpace's UI server WebSocket accepts connections from all origins...
CVE-2026-40893: Gotenberg Allows Arbitrary File Manipulation
CVE-2026-40893 — Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, Gotenberg only checks if the tag is exactly FileName, so System:FileName...