CVE-2026-39918
CRITICALVvveb < 1.0.8.1 Code Injection via Installation Endpoint
Title source: cnaDescription
Vvveb prior to 1.0.8.1 contains a code injection vulnerability in the installation endpoint where the subdir POST parameter is written unsanitized into the env.php configuration file without escaping or validation. Attackers can inject arbitrary PHP code by breaking out of the string context in the define statement to achieve unauthenticated remote code execution as the web server user.
References (3)
Core 3
Core References
Release Notes release-notes
https://github.com/givanz/Vvveb/releases/tag/1.0.8.1
Third Party Advisory third-party-advisory
https://www.vulncheck.com/advisories/vvveb-code-injection-via-installation-endpoint
Scores
CVSS v3
9.8
EPSS
0.0066
EPSS Percentile
46.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
total
Details
CWE
CWE-94
Status
published
Products (2)
givanz/Vvveb
< 1.0.8.1
givanz/Vvveb
5162c1639130bd080ab63c7d856788cd59d6b3b7
Published
Apr 20, 2026
Tracked Since
Apr 20, 2026