CVE-2026-126378 is a critical file upload flaw in Vvveb through version 1.0.8.6: an attacker with admin credentials can bypass the theme installer's file validation and achieve remote code execution on nginx deployments.
What Is It
CVE-2026-126378 is an unrestricted file upload weakness (CWE-434) in the Vvveb theme installer. The validFile() function checks uploaded paths with strpos() instead of strict path matching. An attacker can upload a ZIP archive with a PHP file whose path includes /theme.php, and the check accepts it. On nginx deployments, this leads to remote code execution.
VulnCheck disclosed the issue. NVD published the record on 2026-11-13, and its NVD status is currently "Deferred."
Why It Matters
VulnCheck scores this as critical:
- CVSS 3.1: 9.1 (CRITICAL),
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - CVSS 4.0: 9.4 (CRITICAL)
The attack works over the network with low complexity and needs no user interaction. Confidentiality, integrity and availability impacts are all rated high. The scope is "Changed," which means a successful compromise can reach beyond the vulnerable component.
Exploitation requires high privileges (admin credentials). That raises the bar, but an attacker with a stolen, phished or reused admin login could plant a webshell and take over the server.
This CVE has no CISA KEV entry, so active exploitation is not confirmed at this time.
What's Vulnerable
- Vendor: givanz
- Product: Vvveb
- Affected versions: all versions through 1.0.8.6
- Deployment condition: the description says remote code execution happens on nginx deployments
NVD lists no CPE configurations yet.
Patch Status
The supplied NVD record does not name a fixed version, and there is no KEV-required action because this CVE is not in the KEV catalog. Administrators running Vvveb 1.0.8.6 or earlier should:
- Check the vendor's GitHub security advisory (GHSA-xpgr-r6c8-3hpq) and the VulnCheck advisory for fix and upgrade guidance.
- Treat admin credentials as the main barrier until a fix is applied. Review who has admin access to Vvveb instances, especially those served by nginx.