CVE-2026-6257

Name of the Vulnerable Software and Affected Versions Vvveb CMS version 1.0.8

Description A remote code execution flaw exists in the media management functionality. A missing return statement in the file rename handler allows authenticated attackers to rename files to blocked extensions such as '.php' or '.htaccess'. This logic flaw can be exploited by uploading a text file and renaming it to '.htaccess' to inject Apache directives that register PHP-executable MIME types, followed by uploading another file and renaming it to '.php' to execute arbitrary operating system commands as the www-data user.

Recommendations Update Vvveb CMS version 1.0.8 to a newer version that contains a fix for this issue.