CVE-2026-41936 is an XXE injection vulnerability in Vvveb prior to version 1.0.8.2. The issue exists in the admin Tools/Import feature where the XML parser improperly handles external entity references. Authenticated site_admin users can inject file:// or php://filter entities that get resolved and stored in the application database. This enables arbitrary file disclosure and modification of database records, including overwriting administrator password hashes, which can lead to privilege escalation. The vulnerability is categorized under CWE-611 (Improper Restriction of XML External Entity Reference). The CVSS 4.0 base score is 8.6, indicating high severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality and integrity.

Exploitation allows authenticated site_admin users to read arbitrary files on the server and modify database records. This includes the ability to overwrite administrator password hashes, which can lead to privilege escalation within the application. The vulnerability compromises confidentiality and integrity of the affected system. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor for updates from the vendor. Until a patch is available, restrict access to the admin Tools/Import feature to trusted users only and consider disabling this feature if possible to reduce risk.