CVE-2026-126378

Vvveb remote code execution in theme installer

critical · 9.4

Vvveb

Published Nov 13, 2026, 09:36 UTC

Description

Vvveb through 1.0.8.6 contains a file upload vulnerability in the theme installer validFile() function that uses strpos() instead of strict path matching. Attackers with admin credentials can upload a ZIP containing a PHP file whose path includes /theme.php to achieve remote code execution on nginx deployments.

Official CVE record View source and advisories

Data from cve.now. Summaries, where shown, are licensed CC BY 4.0.