CVE-2026-6249

BRIEFING NOTE: CVE-2026-6249 Vvveb CMS version 1.0.8 contains a critical remote code execution vulnerability in its media upload handler that permits authenticated attackers to execute arbitrary operating system commands by uploading malicious PHP webshells with .phtml extensions, thereby bypassing file extension restrictions and achieving full server compromise. The vulnerability presents a high severity risk with a CVSS score of 8.8, requiring only low attack complexity and authenticated access over the network to exploit. The attack requires no user interaction and can result in complete compromise of system confidentiality, integrity, and availability through placement of executable files in publicly accessible media directories. This vulnerability is not currently listed on the Known Exploited Vulnerabilities catalog and shows minimal exploitation activity, with an EPSS score of 0.0009 indicating lower real-world exploitation probability. No public exploit code is currently documented, and community attention remains low, though the FAUCET risk score of 52.0 suggests continued monitoring is warranted for organizations running affected versions.