CVE-2026-41936 Vvveb < 1.0.8.2 XML External Entity Injection via Import
Authenticated site admins can exploit XXE in the import feature to read arbitrary files and escalate privileges by overwriting password hashes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-41936?
CVE-2026-41936 is a high-severity vulnerability in givanz Vvveb, published on 6 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Vvveb before version 1.0.8.2 contains an XML external entity (XXE) injection vulnerability in the admin Tools/Import feature that allows authenticated site_admin users to read arbitrary files and modify database records. Attackers can exploit the XML parser configuration in system/import/xml.php to inject file:// or php://filter entity references that are resolved and persisted into the application database, enabling arbitrary file disclosure and administrator password hash overwriting for privilege escalation.
Weakness: CWE-611
Which versions are affected by CVE-2026-41936?
How do I fix CVE-2026-41936?
No fix has been published for CVE-2026-41936 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-41936 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-41936 exists.
Sources
Also known as GHSA-rfxr-4xpm-wrp7.