CVE-2026-6257

OVERVIEW CVE-2026-6257 is a remote code execution vulnerability affecting Vvveb CMS v1.0.8, located in the media management functionality. A missing return statement in the file rename handler permits authenticated attackers to rename files to dangerous extensions including .php and .htaccess, bypassing extension-based access controls. SEVERITY This vulnerability carries a CVSS v3.1 score of 9.1 (CRITICAL) with a network-based attack vector requiring high-level privileges but no user interaction. The attack has significant scope and impact, enabling compromise of confidentiality, integrity, and availability. Exploitation involves a two-stage attack where an attacker first renames an uploaded text file to .htaccess to inject Apache directives that register PHP as an executable MIME type, then uploads and renames a second file to .php to execute arbitrary operating system commands with www-data user privileges. EXPLOITATION STATUS Active exploitation of this vulnerability appears limited. It is not currently tracked on the CISA Known Exploited Vulnerabilities catalog and has no public exploit code listed on exploit databases. The EPSS score of 0.0024 indicates this vulnerability ranks lower than approximately 99.5 percent of all CVEs in terms of probability of exploitation, suggesting minimal community or threat actor attention at present.