The vulnerability in Vvveb prior to version 1.0.8.2 involves unrestricted file upload (CWE-434) in the media upload handler. Attackers with media-upload permissions can upload a .htaccess file to override extension restrictions and map .phtml files to the PHP handler. Subsequently, they can upload malicious .phtml files containing arbitrary PHP code. These files can be triggered remotely without authentication, leading to remote code execution on the web server with the privileges of the web server process. The CVSS 4.0 base score is 8.7, indicating a high severity vulnerability.

Successful exploitation allows remote code execution on the web server with the privileges of the web server process. This can lead to full compromise of the affected system, including unauthorized access, data theft, or further attacks within the network. The vulnerability requires authenticated access with media-upload permissions but no user interaction is needed to trigger the payload once uploaded.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict media-upload permissions to trusted users only and monitor uploads for suspicious files. Consider disabling .htaccess overrides or restricting the ability to upload configuration files if possible.