Vvveb CVE-2026-41931

The vulnerability requires only network access to the password-reset endpoint without authentication or user interaction. Exploitation is restricted to instances where debug mode is enabled by default or not explicitly disabled-this is the case in Vvveb versions before 1.0.8.2. No special configuration is required; the flaw is present in standard installations. The attack is further limited to environments where the admin password-reset endpoint is network-accessible (not blocked by firewall or network segmentation). If an organization isolates the admin interface behind a VPN or IP whitelist, the attack surface is reduced. Note: Debug mode may have been manually disabled by administrators in some deployments, which would prevent exploitation; however, the default configuration in vulnerable versions leaves systems exposed.

The CVSS 6.9 score reflects a network-accessible vulnerability with low confidentiality impact (VC:L) and no integrity or availability impact. However, CVSS alone underestimates real-world risk because information disclosure vulnerabilities are foundational to multi-stage attacks. The low attack complexity (AC:L), lack of authentication (PR:N), and no user interaction requirement (UI:N) mean any network attacker can trivially trigger the flaw by requesting the password-reset endpoint. The disclosed information-file paths, class namespaces, line numbers-directly enables subsequent attacks: attackers can identify server software versions, locate vulnerable components, and craft targeted exploits against other flaws. The CVSS confines 'impact' to confidentiality loss, but in reconnaissance and supply-chain attack scenarios, this is high-value. No EPSS, KEV, or POC data is provided in the input, so exploitation probability cannot be cross-checked; however, the vulnerability is trivial to discover and exploit (no complex PoC required-simply accessing a malformed endpoint). The fact that debug mode was enabled by default in affected versions increases likelihood of real-world exposure. Risk priority should be elevated for internet-facing Vvveb instances, especially those handling e-commerce or sensitive content; internal or isolated deployments face lower practical risk.

An attacker performs reconnaissance on a target running Vvveb by sending an HTTP GET or POST request to the admin password-reset endpoint (e.g., /admin/password-reset). The missing namespace import causes a fatal PHP error. Because debug mode is enabled by default in vulnerable versions, the exception handler renders the full stack trace directly in the HTTP response. The attacker observes the response, extracting the absolute file system path (e.g., /var/www/html/vvveb/...), class namespaces, and line numbers, which reveal the application structure and enable follow-up attacks.