Vvveb before 1.0.9.0 RCE via.phar Extension Denylist Bypass in Media Upload
Not on CISA's list of exploited flaws, and not in the news we track.
9.4of 10, critical
Fix it in your code
Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-126380. Nothing runs until you send it.
Vvveb before 1.0.9.0 contains a denylist bypass in system/traits/media.php where '.phar' is misconfigured with a leading dot, allowing authenticated administrators to upload.phar PHP files. Attackers can upload a GIF magic-byte polyglot webshell bypassing binary inspection and execute arbitrary OS commands as the web-server user.