CVE-2026-126378givanz Vvveb

Vvveb through 1.0.8.6 Webshell Upload via Theme Installer validFile() Bypass

Not on CISA's list of exploited flaws, and not in the news we track.

SeverityCVSS

9.4of 10, critical

010

Exploited in the wild: Not confirmedBy CISA
Chance of exploitation: Not scored yetEPSS, next 30 days
Used in ransomware: Not known
US federal deadline: None set

Fix it in one click

Fix it in your code

Claude Code Codex Cursor Claude Code (web)

Explain it to me

Claude ChatGPT

Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-126378. Nothing runs until you send it.

About this flaw

Vvveb through 1.0.8.6 contains a file upload vulnerability in the theme installer validFile() function that uses strpos() instead of strict path matching. Attackers with admin credentials can upload a ZIP containing a PHP file whose path includes /theme.php to achieve remote code execution on nginx deployments.

Published: 13 Nov 2026
Weakness: CWE-434

What should I do about this?

Advisories and references