CVE-2026-41938: Givanz Vvveb

High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days.

Vvveb before version 1.0.8.2 contains an unrestricted file upload vulnerability in the media upload handler that allows authenticated users with media-upload permissions to bypass extension restrictions by uploading a .htaccess file to map .phtml extensions to the PHP handler. Attackers can upload a .phtml file containing arbitrary PHP code and execute the uploaded payload through a subsequent unauthenticated HTTP GET request to the uploaded file, resulting in remote code execution with web server privileges.

Affected products

• Givanz Vvveb: before 1.0.8.2 (fixed in 1.0.8.2)

Published 2026-05-06. Last modified 2026-06-17.