Vvveb before version 1.0.8.2 contains an authenticated remote code execution vulnerability in the admin code editor. The vulnerability allows low-privilege authenticated users (editor, author, contributor, or site_admin roles) to execute arbitrary code by exploiting insufficient file extension restrictions. Attackers can write a malicious .htaccess file to map arbitrary extensions to the PHP handler, then upload PHP code with that extension. This can lead to unauthenticated remote code execution when the malicious file is accessed via HTTP. The vulnerability affects the admin code editor component and has been addressed in version 1.0.8.2.