CVE-2026-6249 describes a vulnerability in Vvveb CMS 1.0.8.2 where the media upload handler improperly restricts file types, enabling authenticated users to upload malicious PHP webshell files with a .phtml extension. This bypasses the extension deny-list and places the file in a publicly accessible media directory. Attackers can then invoke the uploaded webshell over HTTP to execute arbitrary OS commands remotely, resulting in remote code execution and full server compromise. The CVSS 4.0 base score is 8.7, indicating high severity. No official patch or remediation guidance is currently available from the vendor.

Successful exploitation allows authenticated attackers to execute arbitrary operating system commands on the server hosting Vvveb CMS 1.0.8.2. This can lead to full server compromise, including unauthorized access, data theft, and further network pivoting. The vulnerability arises from insufficient validation of uploaded file types, permitting dangerous file uploads that are publicly accessible and executable.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the media upload functionality to trusted users only and consider implementing additional server-side controls to block execution of .phtml files or other potentially dangerous file types in the media directory. Monitoring and restricting authenticated user uploads can reduce risk but does not fully mitigate the vulnerability.