CVE-2026-39918: Vvveb < 1.0.8.1 Code Injection via Installation Endpoint

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-20 · updated 2026-10-26
Weakness: CWE-94

Description

Vvveb prior to 1.0.8.1 contains a code injection vulnerability in the installation endpoint where the subdir POST parameter is written unsanitized into the env.php configuration file without escaping or validation. Attackers can inject arbitrary PHP code by breaking out of the string context in the define statement to achieve unauthenticated remote code execution as the web server user.

Affected products

givanz Vvveb: before 1.0.8.1 — fixed in 1.0.8.1

How to fix

Upgrade to a fixed version: givanz Vvveb 1.0.8.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-39918 or the next vulnerability affects your stack