CVE-2026-41937 describes an unrestricted file upload vulnerability in the givanz Vvveb product before version 1.0.8.3. The issue exists in the plugin upload endpoint, where super_admin users can upload a crafted ZIP file containing a plugin.php with a valid Slug header and a public/index.php file with arbitrary PHP code. When the public path of the plugin is accessed via unauthenticated HTTP requests, the malicious PHP code executes with the privileges of the web server user. This allows remote code execution through crafted plugin uploads. The CVSS 4.0 base score is 8.6, indicating high severity. No official patch or remediation level has been published by the vendor as of the data provided.

Successful exploitation allows an attacker with super_admin privileges to execute arbitrary PHP code on the web server, potentially leading to full server compromise or unauthorized actions performed with the web server's privileges. This can result in data theft, service disruption, or further internal network compromise. The vulnerability does not require user interaction and can be triggered via unauthenticated HTTP requests to the uploaded plugin's public path.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict super_admin user access to trusted personnel only and monitor for suspicious plugin uploads. Consider disabling plugin uploads if feasible. No vendor advisory or official fix has been published to date.