CVE-2026-126378
CRITICAL
NVD
CVSS Score
9.1
Severity
CRITICAL
Published
Nov 13, 2026
Vendor
unknown
Description
Vvveb through 1.0.8.6 contains a file upload vulnerability in the theme installer validFile() function that uses strpos() instead of strict path matching. Attackers with admin credentials can upload a ZIP containing a PHP file whose path includes /theme.php to achieve remote code execution on nginx deployments.