Which versions of PHP are affected by CVE-2026-39918?

Vvveb CMS versions before 1.0.8.1 contain a critical remote code execution vulnerability in the installation endpoint that allows unauthenticated attackers to execute arbitrary code and fully…. A patch is available.

How to fix or mitigate CVE-2026-39918?

Within 24 hours: Identify all systems running Vvveb CMS and confirm installed versions; immediately restrict network access to the installation endpoint (/install or equivalent) or take the application offline if patching cannot be completed. Within 7 days: Upgrade all Vvveb CMS instances to version 1.0.8.1 or later. Within 30 days: Conduct forensic review of web server logs for exploitation attempts; rotate all credentials associated with affected systems; validate system integrity and check for unauthorized code or backdoors.

PHP CVE-2026-39918

Q: What is the CVSS score of CVE-2026-39918?

CVE-2026-39918 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-23868 CRITICAL

Code Injection (CWE-94)

2026-04-20 VulnCheck

GHSA-chhv-69jq-q952

PHP Code Injection RCE Vvveb

9.2

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 20, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

Apr 20, 2026 - 16:22 NVD

9.8 (CRITICAL) 9.2 (CRITICAL)

Analysis Generated

Apr 20, 2026 - 15:51 vuln.today

EUVD ID Assigned

Apr 20, 2026 - 15:15 euvd

EUVD-2026-23868

Analysis Generated

Apr 20, 2026 - 15:15 vuln.today

Patch released

Apr 20, 2026 - 15:15 nvd

Patch available

CVE Published

Apr 20, 2026 - 14:46 nvd

CRITICAL 9.2

DescriptionCVE.org

Vvveb prior to 1.0.8.1 contains a code injection vulnerability in the installation endpoint where the subdir POST parameter is written unsanitized into the env.php configuration file without escaping or validation. Attackers can inject arbitrary PHP code by breaking out of the string context in the define statement to achieve unauthenticated remote code execution as the web server user.

AnalysisAI

Remote code execution in Vvveb CMS versions prior to 1.0.8.1 allows unauthenticated attackers to inject arbitrary PHP code through the installation endpoint's subdir parameter, which is written directly into env.php without sanitization. The vulnerability enables complete system compromise as the web server user with no authentication required. Publicly available patch exists (version 1.0.8.1) with detailed fix commit reference.

Technical ContextAI

Vvveb is an open-source PHP-based website builder and CMS (cpe:2.3:a:givanz:vvveb). This vulnerability is a CWE-94 code injection flaw in the installation process. During setup, the application writes the 'subdir' POST parameter directly into the env.php configuration file within a PHP define() statement without escaping or validation. An attacker can break out of the string context by injecting crafted payloads containing PHP code delimiters or escape sequences. Since env.php is executed as PHP during runtime, the injected code executes with the privileges of the web server process (typically www-data or apache). The vulnerability exists in the installation endpoint, which is typically accessible before authentication mechanisms are fully initialized, making it remotely exploitable without credentials.

RemediationAI

Immediately upgrade to Vvveb version 1.0.8.1 or later from the official GitHub release (https://github.com/givanz/Vvveb/releases/tag/1.0.8.1). The fix commit 5162c1639130bd080ab63c7d856788cd59d6b3b7 implements proper input validation and sanitization for the subdir parameter. For organizations unable to upgrade immediately, implement the following compensating controls: (1) Disable or remove access to the installation endpoint entirely by deleting installation scripts or blocking HTTP access to /install/ paths at the web server level (note: this prevents new installations but protects existing deployments); (2) Implement web application firewall (WAF) rules to block requests to installation endpoints containing PHP code patterns such as semicolons, backticks, or function calls in the subdir parameter (caution: may produce false positives if legitimate subdirectory names contain special characters); (3) Restrict network access to installation endpoints using IP allowlisting if setup activities are ongoing (requires maintaining accurate allowlist and doesn't protect against insider threats). Verify env.php file integrity after applying patches to ensure no injected code persists from prior exploitation. Full advisory available at https://www.vulncheck.com/advisories/vvveb-code-injection-via-installation-endpoint.