Vvveb CVE-2026-39918

The installation endpoint must be accessible to the attacker, which occurs in newly deployed Vvveb instances before installation completion, development/staging environments where installation scripts remain enabled, or production deployments where administrators failed to remove or restrict access to installation paths after setup. The vulnerability specifically affects the POST parameter handling in the installation workflow where env.php configuration file generation occurs. Exploitation does NOT require: authentication credentials, existing user accounts, special PHP configurations, or specific server platform. Exploitation is LIMITED by: removal of installation scripts post-deployment (common security practice), web server access controls blocking /install/ paths, file system permissions preventing env.php writes (uncommon in functional installations). The vulnerability is exploitable against default Vvveb configurations during and immediately after installation phase.

This represents critical real-world risk requiring immediate attention. The CVSS 3.1 score of 9.8 with vector AV:N/AC:L/PR:N/UI:N indicates network-accessible exploitation requiring no authentication, low complexity, and no user interaction, with complete compromise of confidentiality, integrity, and availability. While EPSS data and KEV status are not provided in available intelligence, the technical characteristics suggest high exploitability: installation endpoints are common attack targets, code injection in configuration files is well-understood, and PHP injection techniques are widely documented. The VulnCheck advisory publication indicates security researcher attention, increasing likelihood of exploit development. The primary risk limitation is that many production Vvveb instances may have completed installation and removed or restricted access to the installation endpoint, significantly reducing the attack surface. Organizations with newly deployed or development instances of Vvveb face immediate risk. The availability of a specific patch commit (5162c1639130bd080ab63c7d856788cd59d6b3b7) and release (1.0.8.1) indicates vendor responsiveness, but unpatched instances remain critically vulnerable.

An unauthenticated attacker identifies a Vvveb installation with an accessible setup endpoint. They send a crafted HTTP POST request to the installation script with a malicious subdir parameter containing injected PHP code (e.g., 'subdir' => '/example'; system($_GET['cmd']); //'). The application writes this payload directly into env.php, breaking out of the intended string context and injecting executable code. When the application subsequently includes or executes env.php, the injected code runs as the web server user, allowing the attacker to execute arbitrary system commands, exfiltrate sensitive data, modify application files, or establish persistent backdoor access.