Back to overview

CVE-2026-39918

CRITICAL
9.8
CVSS 3.1
Description
Vvveb prior to 1.0.8.1 contains a code injection vulnerability in the installation endpoint where the subdir POST parameter is written unsanitized into the env.php configuration file without escaping or validation. Attackers can inject arbitrary PHP code by breaking out of the string context in the define statement to achieve unauthenticated remote code execution as the web server user.

Metadata

CVE ID
CVE-2026-39918
State
PUBLISHED
Assigner
VulnCheck
Reserved
2026-04-07 20:57 UTC
Published
2026-04-20 14:46 UTC
Last updated
2026-05-08 14:08 UTC
Primary CWE
CWE-94
Improper Control of Generation of Code ('Code Injection')
Vendor / Product
givanz / Vvveb
Sources
cve.org  ·  NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
none
Automatable
yes
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
givanz Vvveb — 0 < 1.0.8.1, 5162c1639130bd080ab63c7d856788cd59d6b3b7
Weakness (CWE)
CWESourceDescription
CWE-94 cna Improper Control of Generation of Code ('Code Injection')
CVSS scores (2)
ScoreSeverityVersionSourceVector
9.8 CRITICAL 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.2 CRITICAL 4.0 cna CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References (3)
Back to overview