PT-2026-33779 · Vvveb · Vvveb

Vulncheck · CVE-2026-39918 · Published 2026-04-20 · Updated 2026-04-21

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vvveb versions prior to 1.0.8.1

Description An issue exists in the installation endpoint where the subdir POST parameter is written into the env.php configuration file without proper escaping or validation. This allows unauthenticated attackers to break out of the string context in the define statement and inject arbitrary PHP code, leading to remote code execution as the web server user.

Recommendations Update to version 1.0.8.1 or later.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-39918

Affected Products

Vvveb

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39918.json · Exploit
• https://github.com/givanz/Vvveb/commit/5162c1639130bd080ab63c7d856788cd59d6b3b7 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-39918 · Security Note
• https://osv.dev/vulnerability/CVE-2026-39918 · Vendor Advisory
• https://github.com/givanz/Vvveb · Note
• https://github.com/givanz/Vvveb/releases/tag/1.0.8.1 · Note
• https://twitter.com/VulmonFeeds/status/2046287641327386727 · Twitter Post
• https://twitter.com/0dayPublishing/status/2046245020563288503 · Twitter Post
• https://twitter.com/CVEnew/status/2046601507680752095 · Twitter Post
• https://vulncheck.com/advisories/vvveb-code-injection-via-installation-endpoint · Note
• https://twitter.com/PurpleOps_io/status/2046446713213251976 · Twitter Post
• https://twitter.com/OrizonCyber/status/2046265158771597596 · Twitter Post