CVE-2026-39918

Vvveb versions prior to 1.0.8.1 are affected by a critical code injection vulnerability in the installation endpoint where the subdir POST parameter is written unsanitized into the env.php configuration file, allowing attackers to inject arbitrary PHP code and achieve unauthenticated remote code execution. The vulnerability carries a CVSS score of 9.8 (Critical) due to its network-based attack vector, low complexity, and lack of required privileges or user interaction, resulting in complete compromise of confidentiality, integrity, and availability. While the CVE is listed as active on vulnerability tracking lists, the EPSS score of 0.00218 indicates relatively low exploit prevalence compared to other CVEs in circulation, suggesting limited current exploitation activity despite the vulnerability's severe risk profile.