What’s Vulnerable › Vulnerabilities

CVE-2026-41933: Vvveb < 1.0.8.3 Directory Listing Information Disclosure

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-14 · updated 2026-10-26
• Weakness: CWE-548

Description

Vvveb before 1.0.8.3 contains a directory listing information disclosure vulnerability that allows unauthenticated attackers to enumerate files and directories by accessing multiple paths lacking proper index directives in .htaccess files. Attackers can access directories such as admin asset paths, plugins, themes, and media folders to view filenames, file sizes, modification timestamps, and unrendered admin templates containing sensitive route maps.

Affected products

• givanz Vvveb: before 1.0.8.3 — fixed in 1.0.8.3

How to fix

Upgrade to a fixed version: givanz Vvveb 1.0.8.3. Check the vendor advisory for mitigations.

References

• https://github.com/givanz/Vvveb/commit/96ae04c5e4a295e281adc1d02d77444173653deb
• https://github.com/givanz/Vvveb/releases/tag/1.0.8.3
• https://www.vulncheck.com/advisories/vvveb-directory-listing-information-disclosure

Get alerted when CVE-2026-41933 or the next vulnerability affects your stack