CVE-2026-41934

🎯 CVE-2026-41934 🧪 PoC 🇪🇺 EUVD

💬 0 Diskussion 📄 .md Alle CVEs anzeigen ✕

CVE-2026-41934 | Vvveb before version 1.0.8.2 contains an authenticated remote code execution vulnerability in the admin code editor that allows low-privilege authenticated users to execute arbitrary code through insufficient file extension restrictions, with the uploaded payload then executable via subsequent unauthenticated HTTP requests. Attackers with editor, author, contributor, or site_admin roles can write a malicious .htaccess file to map arbitrary extensions to the P

Vvveb before version 1.0.8.2 contains an authenticated remote code execution vulnerability in the admin code editor that allows low-privilege authenticated users to execute arbitrary code through insufficient file extension restrictions, with the uploaded payload then executable via subsequent unauthenticated HTTP requests. Attackers with editor, author, contributor, or site_admin roles can write a malicious .htaccess file to map arbitrary extensions to the PHP handler, then upload PHP code with that extension to achieve unauthenticated remote code execution when the file is accessed via HTTP.

Klassifikation & Betroffenheit:

CWE-184 givanz Vvveb 0 <1.0.8.2

Incomplete List of Disallowed Inputs

The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

🛡️ Empfohlene Mitigation: Do not rely exclusively on detecting disallowed inputs. There are too many variants to encode a character, especially when different environments are used, so there is a high likelihood of missing some variants. Only use detection of disallowed inputs as a mechanism for detecting suspicious activity. Ensure that you ar…

Vollständige Definition bei MITRE ➔

⚔️ Typische Angriffsmuster (CAPEC):

CAPEC-3 · Using Leading 'Ghost' Character Sequence… (Medium) CAPEC-6 · Argument Injection (High) CAPEC-15 · Command Delimiters (High) CAPEC-43 · Exploiting Multiple Input Interpretation… (High) CAPEC-71 · Using Unicode Encoding to Bypass Validat… (High) CAPEC-73 · User-Controlled Filename (High) CAPEC-120 · Double Encoding (Medium) CAPEC-182 · Flash Injection (Medium)

🧩 Ähnliche Schwachstellen (Hersteller/Klasse/Score-Band):

CVE-2026-33396 10.0 CVE-2026-74886 9.3 CVE-2025-71323 9.3 CVE-2025-71320 9.3 CVE-2026-102829 9.2

🩹 Patch verfügbar (OSV):

🩹 8b9db6a408ba35d8ac1dd078823c73f76584d78f (Commit) 🩹 1196561276a3f49da5a714fef89ac9a6c6f9e33b (Commit)

📚 Referenzen & Quellen:

🇪🇺 Original-Eintrag (ENISA EUVD) 🇺🇸 NVD-Eintrag

Ausnutzungs-Zeitleiste:

Reserviert 2026

Veröffentlicht 05/2026

Heute 22.10.

CVSS-Vektor-Analyse: 8.7

AV · Angriffsvektor Netzwerk

AC · Komplexität Gering

PR · Privilegien Gering

UI · Interaktion Keine

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CNA-Bewertung (VulnCheck): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA…

Veröffentlicht:06.05.2026

Aktualisiert:17.06.2026 10:47

Assigner (CNA):VulnCheck

EUVD-ID:EUVD-2026-27889

Quellen: 🇪🇺 EUVD-Datenbank (ENISA) + 🇺🇸 NVD-Anreicherung · 24-h-Cache

CWE-184 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

Tier	CVEs	Anteil
≥90 %	725	0,2 %
≥50 %	3.224	0,9 %
≥10 %	22.086	5,9 %
<10 %	346.657	93,0 %

Tier

CVEs

Anteil

≥90 %

725

0,2 %

≥50 %

3.224

0,9 %

≥10 %

22.086

5,9 %

<10 %

346.657

93,0 %

Noch keine Analyse zu CVE-2026-41934

Beitrag zu CVE-2026-41934 verfassen

Zero-Day & Vulnerability Intelligence Hub