CVE-2026-41936 is an XXE injection vulnerability in Vvveb prior to version 1.0.8.2. The vulnerability exists in the XML parser configuration within system/import/xml.php, which processes XML input in the admin Tools/Import feature. Authenticated site_admin users can inject file:// or php://filter external entity references that are resolved and stored in the application database. This enables attackers to read arbitrary files and overwrite administrator password hashes, facilitating privilege escalation.

Successful exploitation allows authenticated site_admin users to read arbitrary files on the server and modify database records, including overwriting administrator password hashes. This can lead to unauthorized access escalation and compromise of sensitive data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the admin Tools/Import feature to trusted users only and monitor for suspicious activity related to XML import operations.