CVE-2026-126380
CRITICAL
NVD
CVSS Score
9.1
Severity
CRITICAL
Published
Nov 13, 2026
Vendor
unknown
Description
Vvveb before 1.0.9.0 contains a denylist bypass in system/traits/media.php where '.phar' is misconfigured with a leading dot, allowing authenticated administrators to upload .phar PHP files. Attackers can upload a GIF magic-byte polyglot webshell bypassing binary inspection and execute arbitrary OS commands as the web-server user.