CVE-2026-6249 is a remote code execution vulnerability in Vvveb CMS 1.0.8 caused by improper validation of uploaded media files. The media upload handler fails to block files with dangerous extensions such as .phtml, enabling authenticated attackers to upload PHP webshells. Once uploaded, these files can be accessed via HTTP, allowing execution of arbitrary OS commands on the server. This vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) and has a CVSS 4.0 base score of 8.7, indicating high severity. No vendor patch or official remediation has been published as of the vulnerability disclosure date.

Successful exploitation allows an authenticated attacker to execute arbitrary operating system commands on the server hosting Vvveb CMS 1.0.8. This can lead to full server compromise, including unauthorized access, data theft, or further attacks within the network. The vulnerability arises from the ability to upload a PHP webshell with a .phtml extension, bypassing extension filtering and enabling remote code execution via HTTP requests.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the media upload functionality to trusted users only and consider implementing additional server-side validation to block dangerous file types such as .phtml. Monitoring and restricting HTTP access to uploaded files in the media directory may reduce exposure. Avoid exposing the media directory publicly if possible.