Critical severity · published Apr 20, 2026
CVE-2026-39918
Vvveb < 1.0.8.1 Code Injection via Installation Endpoint
9.8
CVSS
0.7%
EPSS
No
On KEV
Description
Vvveb prior to 1.0.8.1 contains a code injection vulnerability in the installation endpoint where the subdir POST parameter is written unsanitized into the env.php configuration file without escaping or validation. Attackers can inject arbitrary PHP code by breaking out of the string context in the define statement to achieve unauthenticated remote code execution as the web server user.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VV
Vvveb · givanz
before 1.0.8.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-39918
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-39918
github.com
https://github.com/givanz/Vvveb/commit/5162c1639130bd080ab63c7d856788cd59d6b3b7
github.com
https://github.com/givanz/Vvveb/releases/tag/1.0.8.1
www.vulncheck.com
https://www.vulncheck.com/advisories/vvveb-code-injection-via-installation-endpoint
More from Vvveb
9.8
CVE-2026-41930
Vvveb < 1.0.8.2 Hard-coded Credentials Information Disclosure via phpMyAdmin
9.8
CVE-2025-9397
givanz Vvveb media.php unrestricted upload
8.8
CVE-2026-54612
Vvveb: Authenticated editor path traversal to PHP file write/RCE via data-v-save-global
8.8
CVE-2026-49228
Vvveb product authorization bypass allows Vendors to read, duplicate, or delete other Vendors' products
8.8
CVE-2026-49221
Vvveb digital asset authorization bypass allows Vendors to list, read, edit, or delete other Vendors' digital assets