CVE 9.2 CRITICAL

Vvveb < 1.0.8.1 Code Injection via Installation Endpoint_CVE-2026-39918

April 20, 2026 invoker category_cve

9.2 / 10

CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Description

Vvveb prior to 1.0.8.1 contains a code injection vulnerability in the installation endpoint where the subdir POST parameter is written unsanitized into the env.php configuration file without escaping or validation. Attackers can inject arbitrary PHP code by breaking out of the string context in the define statement to achieve unauthenticated remote code execution as the web server user.

AI Analysis

Code injection vulnerability in the installation endpoint of Vvveb prior to 1.0.8.1, allowing unauthenticated remote code execution as the web server user.

Basic Information

ID CVE-2026-39918

Source VulnCheck

Published Apr 20, 2026 at 14:46

Modified Apr 20, 2026 at 15:36

Affected Product

Vendor givanz

Product Vvveb

Affected Versions givanz Vvveb 0

CWE Classification

CWE-94

AI Assessment

AI Score 9.2 / 10

AI Severity Critical

Vendor givanz

Product Vvveb

Version < 1.0.8.1

References

{
    "lastseen": "",
    "description": "Vvveb prior to\u00a01.0.8.1 contains a code injection vulnerability in the installation endpoint where the subdir POST parameter is written unsanitized into the env.php configuration file without escaping or validation. Attackers can inject arbitrary PHP code by breaking out of the string context in the define statement to achieve unauthenticated remote code execution as the web server user.",
    "published": "2026-04-20T14:46:33.549Z",
    "modified": "2026-04-20T15:36:55.619Z",
    "type": "cve",
    "title": "Vvveb < 1.0.8.1 Code Injection via Installation Endpoint",
    "source": "VulnCheck",
    "references": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.1\nhttps://github.com/givanz/Vvveb/commit/5162c1639130bd080ab63c7d856788cd59d6b3b7\nhttps://www.vulncheck.com/advisories/vvveb-code-injection-via-installation-endpoint",
    "id": "CVE-2026-39918",
    "bulletinFamily": "",
    "cwe": [
        "CWE-94"
    ],
    "cvelist": null,
    "sourceData": "givanz Vvveb 0",
    "sourceHref": "",
    "cvss": {
        "score": 9.2,
        "severity": "CRITICAL",
        "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "Vvveb",
    "version": "0",
    "vendor": "givanz",
    "ai_description": "Code injection vulnerability in the installation endpoint of Vvveb prior to 1.0.8.1, allowing unauthenticated remote code execution as the web server user.",
    "ai_severity": "Critical",
    "ai_vendor": "givanz",
    "ai_product": "Vvveb",
    "ai_version": "< 1.0.8.1",
    "ai_score": 9.2
}

💭 Join the Security Discussion ❌ Cancel Reply