givanz Vvveb up to 1.0.8.2 Plugin Upload Endpoint plugin.php unrestricted upload

Summaryinfo

A vulnerability classified as critical has been found in givanz Vvveb. The impacted element is an unknown function of the file plugin.php of the component Plugin Upload Endpoint. The manipulation leads to unrestricted upload. This vulnerability is uniquely identified as CVE-2026-41937. The attack is possible to be carried out remotely. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in givanz Vvveb. It has been rated as critical. This issue affects some unknown processing of the file plugin.php of the component Plugin Upload Endpoint. The manipulation with an unknown input leads to a unrestricted upload vulnerability. Using CWE to declare the problem leads to CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Vvveb before 1.0.8.3 contains an unrestricted file upload vulnerability in the plugin upload endpoint that allows super_admin users to execute arbitrary PHP code by uploading a malicious plugin ZIP file. Attackers can craft a ZIP containing a plugin.php with a valid Slug header and a public/index.php file with arbitrary PHP code, which executes as the web server user once accessed via subsequent unauthenticated HTTP requests to the plugin's public path.

The weakness was disclosed by Basant Kumar. It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-41937 since 04/22/2026. The exploitation is known to be easy. The attack may be initiated remotely. Additional levels of successful authentication are required for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1608.002 according to MITRE ATT&CK.

By approaching the search of inurl:plugin.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 1.0.8.3 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 04f0294350ec429e307cd31c2e777a4797c868d6 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-30297). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• givanz

Name

• Vvveb

Version

• 1.0.5
• 1.0.6
• 1.0.6.1
• 1.0.7
• 1.0.7.2
• 1.0.8
• 1.0.8.1
• 1.0.8.2

License

• open-source

Website

• Product: https://github.com/givanz/Vvveb/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion