Is PHP affected by CVE-2026-39918?

Vvveb CMS versions before 1.0.8.1 contain a critical remote code execution vulnerability in the installation endpoint that allows unauthenticated attackers to execute arbitrary code and fully compromise affected systems.

CVE-2026-39918

EUVD-2026-23868 CRITICAL

2026-04-20 VulnCheck

PHP Code Injection RCE

9.2

CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 20, 2026 - 16:22 vuln.today

cvss_changed

CVSS Changed

Apr 20, 2026 - 16:22 NVD

9.8 (CRITICAL) 9.2 (CRITICAL)

Analysis Generated

Apr 20, 2026 - 15:51 vuln.today

DescriptionNVD

Vvveb prior to 1.0.8.1 contains a code injection vulnerability in the installation endpoint where the subdir POST parameter is written unsanitized into the env.php configuration file without escaping or validation. Attackers can inject arbitrary PHP code by breaking out of the string context in the define statement to achieve unauthenticated remote code execution as the web server user.

AnalysisAI

Remote code execution in Vvveb CMS versions prior to 1.0.8.1 allows unauthenticated attackers to inject arbitrary PHP code through the installation endpoint's subdir parameter, which is written directly into env.php without sanitization. The vulnerability enables complete system compromise as the web server user with no authentication required. …

RemediationAI

Within 24 hours: Identify all systems running Vvveb CMS and confirm installed versions; immediately restrict network access to the installation endpoint (/install or equivalent) or take the application offline if patching cannot be completed. Within 7 days: Upgrade all Vvveb CMS instances to version 1.0.8.1 or later. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

CVE-2026-39918 vulnerability details – vuln.today

Back

CVE-2026-39918

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

RemediationAI

Analysis

Full analysis requires sign-in

Share

CVE-2026-39918

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

RemediationAI

Full analysis requires sign-in

Share

External POC / Exploit Code