PT-2026-40942 · Givanz+1 · Vvveb

Basant Kumar + 1 · Published 2026-05-14 · Updated 2026-05-14 · CVE-2026-41933

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Vvveb versions prior to 1.0.8.3

Description An information disclosure issue allows unauthenticated attackers to enumerate files and directories. This occurs because multiple paths lack proper index directives in .htaccess files, which are configuration files used by Apache web servers to control directory-level settings. Attackers can access admin asset paths, plugins, themes, and media folders to view filenames, file sizes, modification timestamps, and unrendered admin templates that contain sensitive route maps.

Recommendations Update Vvveb to version 1.0.8.3 or later.

Exploit

Fix

Weakness Enumeration

CWE-548

Related Identifiers

CVE-2026-41933

Affected Products

Vvveb

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41933.json · Exploit
• https://github.com/givanz/Vvveb/commit/96ae04c5e4a295e281adc1d02d77444173653deb · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-41933 · Security Note
• https://osv.dev/vulnerability/CVE-2026-41933 · Vendor Advisory
• https://github.com/givanz/Vvveb · Note
• https://github.com/givanz/Vvveb/releases/tag/1.0.8.3 · Note
• https://vulncheck.com/advisories/vvveb-directory-listing-information-disclosure · Note