CVE-2026-126378

Vvveb versions through 1.0.8.6 are vulnerable to a file upload flaw in the validFile() function of the theme installer. The root cause is the use of strpos() instead of strict path matching. Attackers with admin credentials can exploit this by uploading a ZIP file containing a PHP file with a pat...