CVE-2026-126372
HIGH
NVD
CVSS Score
8.8
Severity
HIGH
Published
Nov 13, 2026
Vendor
unknown
Description
Vvveb through 1.0.8.6 contains an incomplete fix for CVE-2026-41934 that allows authenticated editor or site_admin users to write server-side templates by bypassing save restrictions. Attackers can upload or rename .tpl files via editor/code upload and rename actions, or evade isExecutableFile checks in save(), to inject PHP code into templates.