Security readout for executives and security teams
Plain-English summary
A logged-in Vvveb site administrator can abuse the XML import feature to read sensitive server files and alter database records. This could expose credentials or enable privilege escalation by replacing an administrator password hash. Vvveb versions before 1.0.8.2 are affected.
Executive priority
Treat this as a high-priority upgrade for affected installations, especially where administration is internet-accessible or site_admin accounts are broadly assigned. The authentication requirement reduces exposure, but compromise of one privileged account could lead to sensitive-file theft and stronger administrative control.
Technical view
The admin Tools/Import flow uses unsafe XML parser behavior in system/import/xml.php. External entities referencing local resources can be resolved and stored in the database, causing arbitrary file disclosure or database-record modification. Exploitation requires authenticated site_admin access but needs no user interaction.
Likely exposure
Exposure is limited to Vvveb installations before 1.0.8.2 where an attacker has site_admin access and can use the XML import feature. Internet-accessible administration increases opportunity, but the sources do not establish how commonly the feature or affected versions are deployed.
Exploitation context
The CVSS 4.0 score is 8.6, reflecting network reachability, low complexity, required low privileges, and high confidentiality and integrity impact. The supplied record is not in KEV, and the cited evidence does not establish active exploitation in the wild.
Researcher notes
This is CWE-611. The central condition is external-entity resolution during authenticated XML import, with resolved content persisted into application data. The supplied sources identify file disclosure and database modification, including administrator password-hash replacement. They do not demonstrate unauthenticated access, code execution, service disruption, or exploitation in the wild.
Mitigation direction
- Upgrade Vvveb to version 1.0.8.2 or later.
- Restrict administrative access to trusted users and networks until upgrading.
- Temporarily disable or tightly control XML imports if immediate upgrading is impossible.
- Rotate exposed credentials if investigation indicates sensitive files were accessed.
- Follow the vendor advisory for any additional remediation guidance.
Validation and detection
- Inventory Vvveb installations and confirm their exact versions.
- Verify deployed code includes the vendor's XML import patch.
- Review site_admin accounts for unexpected or excessive privileges.
- Examine import activity and administrative logs for suspicious XML submissions.
- Check administrator records for unexplained password-hash changes.
- Investigate possible disclosure of configuration files, credentials, or other secrets.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-611: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-41936 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.6 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N——VulnCheckCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N2.85.2VulnCheckVulnerability scoring details
Base CVSS 4.0 score
8.6HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Base CVSS 3.1 score
8.1HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/givanz/Vvveb/releases/tag/1.0.8.2CVE reference, VulnCheck · release-notes
- https://github.com/givanz/Vvveb/security/advisories/GHSA-rfxr-4xpm-wrp7CVE reference, VulnCheck · vendor-advisory
- https://github.com/givanz/Vvveb/commit/86f7128a18edebe0ff47e3855558467eb0ef9106CVE reference, VulnCheck · patch
- https://www.vulncheck.com/advisories/vvveb-xml-external-entity-injection-via-importCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Restriction of XML External Entity Reference
Improper Restriction of XML External Entity Reference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.