CVE-2026-39918
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
Vvveb prior to version 1.0.8.1 contains a code injection vulnerability in the installation endpoint where the subdir POST parameter is written unsanitized into the env.php configuration file. Attackers can inject arbitrary PHP code by breaking out of the string context in the define statement, leading to unauthenticated remote code execution as the web server user.
Risk Assessment
The risk for the organization includes full compromise of the web server by an unauthenticated attacker, potentially leading to data theft, content modification, or further attacks on the infrastructure.
Recommendation
Immediately upgrade Vvveb to version 1.0.8.1 or later. If upgrading is not possible, temporarily disable the installation endpoint or apply WAF rules to block suspicious POST parameters.
Original NVD description (English source)
Vvveb prior to 1.0.8.1 contains a code injection vulnerability in the installation endpoint where the subdir POST parameter is written unsanitized into the env.php configuration file without escaping or validation. Attackers can inject arbitrary PHP code by breaking out of the string context in the define statement to achieve unauthenticated remote code execution as the web server user.