CVE-2026-126380 Vvveb before 1.0.9.0 RCE via .phar Extension Denylist Bypass in Media Upload

Vvveb before 1.0.9.0 contains a denylist bypass in system/traits/media.php where '.phar' is misconfigured with a leading dot, allowing authenticated administrators to upload .phar PHP files. Attackers can upload a GIF magic-byte polyglot webshell bypassing binary inspection and execute arbitrary ...