CVE-2026-41938 is an unrestricted file upload vulnerability in Vvveb before version 1.0.8.2 that affects the media upload handler. Authenticated users with media-upload permissions can bypass extension restrictions by uploading a .htaccess file to map .phtml extensions to the PHP handler. Attackers can then upload a .phtml file containing arbitrary PHP code and trigger execution through an unauthenticated HTTP GET request to the uploaded file. This results in remote code execution with web server privileges, making it a critical security issue.