CVE-2026-6249 is a remote code execution vulnerability in Vvveb CMS 1.0.8.2 caused by improper validation of uploaded file types in the media upload handler. The vulnerability allows authenticated users to upload a PHP webshell disguised with a .phtml extension, bypassing the extension deny-list. The uploaded malicious file is placed in a publicly accessible media directory, enabling attackers to execute arbitrary OS commands by accessing the file via HTTP. This vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) and has a CVSS 4.0 score of 8.7, indicating high severity.

Successful exploitation allows authenticated attackers to execute arbitrary operating system commands on the server hosting Vvveb CMS 1.0.8.2. This can lead to full server compromise, including unauthorized access, data theft, or further network pivoting. The vulnerability arises from insufficient validation of file extensions during media uploads, enabling attackers to upload and execute a PHP webshell.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the media upload functionality to trusted users only and consider implementing additional server-side controls to block execution of .phtml files in the media directory. Monitoring for suspicious file uploads and HTTP requests to .phtml files may help detect exploitation attempts.