CVE-2026-39918

CVE-2026-39918 is a code injection vulnerability (CWE-94) affecting Vvveb versions prior to 1.0.8.1. The flaw exists in the installation endpoint, where the subdir POST parameter is written unsanitized into the env.php configuration file without proper escaping or validation. This allows attackers to inject arbitrary PHP code by breaking out of the string context within the define statement. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for widespread remote exploitation.

Any unauthenticated remote attacker can exploit this vulnerability by sending a crafted POST request to the installation endpoint with a malicious subdir parameter. Successful exploitation leads to arbitrary PHP code execution on the server as the web server user, potentially enabling full server compromise, data theft, persistence, or lateral movement within the environment.

Mitigation is available through upgrading to Vvveb version 1.0.8.1 or later, as detailed in the project's GitHub release notes. The specific fix is implemented in commit 5162c1639130bd080ab63c7d856788cd59d6b3b7, which addresses the unsanitized parameter handling. Additional details on the vulnerability and remediation are provided in the VulnCheck advisory.