CVE-2026-39918

Vvveb < 1.0.8.1 Code Injection via Installation Endpoint

State: Published
Severity: 9.2 Critical
Published: Apr 20, 2026
Updated: Jul 28, 2026
Reserved: Apr 7, 2026

Description

Vvveb prior to 1.0.8.1 contains a code injection vulnerability in the installation endpoint where the subdir POST parameter is written unsanitized into the env.php configuration file without escaping or validation. Attackers can inject arbitrary PHP code by breaking out of the string context in the define statement to achieve unauthenticated remote code execution as the web server user.

Scores

CVSS	Score	Vector	Source
4.0	9.2 Critical	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	VulnCheck
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	VulnCheck

Weaknesses

CWE-94 Improper Control of Generation of Code ('Code Injection')

Affected Products

Product	Versions
Vvvebgivanz	before 1.0.8.1Affected 5162c1639130bd080ab63c7d856788cd59d6b3b7Not affected

References

https://github.com/givanz/Vvveb/releases/tag/1.0.8.1release-notes
https://github.com/givanz/Vvveb/commit/5162c1639130bd080ab63c7d856788cd59d6b3b7patch
https://www.vulncheck.com/advisories/vvveb-code-injection-via-installation-endpointthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.