vciy
vciy-2026-0009 · givanz/Vvveb · CWE-434

Incomplete fix for CVE-2026-41934: template extension and executable-content check bypass in Vvveb code editor

Verification of commit 1196561276a3f49da5a714fef89ac9a6c6f9e33b (fixing GHSA-vfjj-gcvv-w248 / CVE-2026-41934 in Vvveb's code editor) identified a mismatch between the code editor's denied-extension list and the shared media trait's upload/rename allowlist, as well as a pre-write check ordering flaw in the file-save handler.

Receipt & provenance · vciy-2026-0009
Advisory ID
vciy-2026-0009canonical vciy advisory identifier
Upstream project
givanz/VvvebPHP
Affected versions
Vvveb <= 1.0.8.6verified on upstream default branch
Weakness class
CWE-434Unrestricted Upload of File with Dangerous Type
Related CVE records
CVE-2026-41934upstream fix commit inspected
Upstream tracking
GHSA-7h6v-ww3f-24pp (private upstream triage)reported 2026-10-22 · Coordinated disclosure in progress
Credit
Jonathan Corners (@JCorners68), Voxell, Inc. (https://vciy.com)discovered and reported
Record CVE-2026-41934 as mitigated Open CVE-2026-41934 evidence page All vciy advisories
01

Root cause and sibling analysis.

When a controller restricts sensitive template extensions in its direct save action but inherits file upload and rename actions from a shared trait, the trait's denied-extension list and role checks must enforce the same boundary across theme and plugin directories.

Detailed handler locations and a remediation diff have been filed privately with the upstream maintainer under GHSA-7h6v-ww3f-24pp via GitHub Private Vulnerability Reporting. Full technical details will be published on this page once an upstream release is available.

02

Remediation.

Upgrade to the patched Vvveb release once published under GHSA-7h6v-ww3f-24pp.