CVE-2026-41936

Name of the Vulnerable Software and Affected Versions Vvveb versions prior to 1.0.8.2

Description An XML external entity (XXE) injection issue exists in the admin Tools/Import feature. Authenticated site admin users can exploit the XML parser configuration in the 'system/import/xml.php' endpoint to inject file:// or php://filter entity references. These references are resolved and persisted into the application database, allowing for arbitrary file disclosure and the overwriting of administrator password hashes to achieve privilege escalation.

Recommendations Update to version 1.0.8.2 or later. As a temporary workaround, restrict access to the 'system/import/xml.php' endpoint.