CVE-2026-6257: Vvveb CMS RCE via Unrestricted File Rename in Media Manager
Vvveb CMS 1.0.8.2 has a missing return statement in its media file rename handler, which lets authenticated users rename files to blocked extensions such as .php and .htaccess. The record reports CVSS 3.1 9.1 (critical) and CWE-434, unrestricted upload of a file with a dangerous type. The vulnerability is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.
Overview
The record describes a flaw in the media management feature of Vvveb CMS 1.0.8.2. A missing return statement in the file rename handler means that a rename check does not stop the operation, so authenticated users can rename files to extensions that should be blocked, namely .php and .htaccess. The record classifies the weakness as CWE-434, unrestricted upload of a file with a dangerous type.
Impact
According to the record description, the flaw can lead to remote code execution as the www-data user on the server hosting the CMS. The CVSS 3.1 base score is 9.1 (critical) with a high privileges-required component and a scope change, and the CNA also provides a CVSS 4.0 score of 9.2. Confidentiality, integrity and availability are all rated high in the 3.1 vector.
Affected products and versions
- Product: Vvveb CMS (project repository referenced in the record).
- Version explicitly named in the record: 1.0.8.2.
- The record does not list affected or fixed version ranges. Other versions are unknown from the available data.
Exploitation status
- CISA KEV: the record shows this CVE is not listed in KEV.
- No confirmed exploitation in the wild appears in the sources consulted for this analysis.
- The EPSS probability is 0.0091 with a percentile of 0.58933, as recorded.
Remediation and mitigation
- Check whether the installed Vvveb CMS is version 1.0.8.2 or another version, and review the upstream commit listed in the references for the code change.
- Apply the vendor or project update once it is confirmed to address this issue; the record does not identify a fixed version.
- Until patched, restrict who holds authenticated media upload and rename permissions and review accounts with those rights.
- Ensure the web server does not execute uploaded content from media directories and limit the web server's ability to read or apply per-directory configuration files in upload paths.
Detection guidance
- Monitor media directories for newly created or renamed files with executable server-side extensions or server configuration filenames.
- Review application logs for rename operations on media items, especially by accounts that do not normally manage files.
- Watch for unexpected PHP execution from upload directories and for changes to web server configuration files.
Limitations of the available information
The analysis relies on the record description and reference list. The VulnCheck advisory and the GitHub commit were listed but their contents were not used as a source of additional facts here. No fixed version, complete affected range, or public exploit status is confirmed by the record. The EPSS date shown in the record is recorded as provided.
Frequently asked questions
Is CVE-2026-6257 being actively exploited?
The record shows this CVE is not listed in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted for this analysis.
Which Vvveb CMS versions are affected?
The record names version 1.0.8.2 explicitly but does not provide an affected range or a fixed version, so other versions are unknown from the available data.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.