CVE Intelligence
Analysis AI-assisted

CVE-2026-39918: Vvveb Code Injection in Installation Endpoint

Vvveb versions before 1.0.8.1 contain a code injection flaw in the installation endpoint, where the subdir POST parameter is written into the env.php configuration file without escaping or validation. The record describes this as enabling unauthenticated remote code execution with the web server user's privileges, and it is rated critical with CVSS 3.1 9.8. No confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes a code injection weakness (CWE-94) in the installation endpoint of Vvveb. The subdir POST parameter is written into env.php without escaping or validation, which the record says can let an attacker break out of a string in a define statement and inject PHP code.

Impact

  • The record states the flaw can lead to unauthenticated remote code execution as the web server user.
  • The NVD-associated record shows a CVSS 3.1 base score of 9.8 (critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and a CVSS 4.0 score of 9.2 from the same CNA.
  • Because the vector indicates no privileges or user interaction are required, exposed installations are the main concern.

Affected products and versions

  • The record states that Vvveb versions prior to 1.0.8.1 are affected.
  • The structured affected and fixes lists in the record are empty, so the exact range and fixed builds must be confirmed against the vendor references.
  • The release tag 1.0.8.1 is referenced, which suggests it is the corrected release (inference).

Exploitation status

  • The record does not list this CVE in the CISA KEV catalog, so active exploitation is not confirmed by that source.
  • No confirmed exploitation in the wild appears in the sources consulted.
  • EPSS shows a probability of 0.01137 with a percentile of 0.65709 in the record.

Remediation and mitigation

  • Upgrade Vvveb to version 1.0.8.1 or later, as indicated by the record and the referenced release.
  • If upgrading cannot be done immediately, restrict access to the installation endpoint to trusted administrators and remove or disable the installer on production systems after setup.
  • Review the web server's exposure of installation paths and limit them with network controls.

Detection guidance

  • Review web server logs for unexpected requests to installation endpoints, especially from unknown sources and at unusual times.
  • Check env.php and similar configuration files for unexpected or modified content, and compare them with known-good copies.
  • Monitor for new or unexpected files and processes started by the web server user.

Limitations of the available information

  • The record does not include structured affected version ranges or fixed version fields.
  • Public proof-of-concept availability is not stated in the record and is unknown.
  • Full technical details beyond the description are not provided in the record, so this analysis does not add exploit specifics.

Frequently asked questions

Which Vvveb versions are affected by CVE-2026-39918?

The record states that Vvveb versions prior to 1.0.8.1 are affected. The structured affected version fields are empty, so confirm the range with the vendor references.

Is this vulnerability known to be exploited in the wild?

The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.