CVE-2026-41931 Details
Description
Vvveb before version 1.0.8.2 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain sensitive server information by triggering unhandled exceptions in the password-reset module. Attackers can access the admin password-reset endpoint to trigger a fatal error caused by a missing namespace import, which exposes the absolute server file path, internal class namespaces, line numbers, and source code excerpts through the debug exception handler rendered to unauthenticated requests.
An information disclosure vulnerability exists in Vvveb versions prior to 1.0.8.2. This vulnerability allows unauthenticated attackers to access sensitive server information by triggering unhandled exceptions in the password-reset module. The issue arises because the module lacks a proper namespace import, causing a fatal error that is rendered through the debug exception handler. This exposed information includes the absolute server file path, internal class namespaces, line numbers, and excerpts of the source code, all through the admin password-reset endpoint.
Users can update to Vvveb version 1.0.8.2 or later, where this vulnerability has been patched. For immediate workaround, edit the 'env.php' file to set 'DEBUG' to false, and restart the PHP-FPM or Apache container.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 6, 2026CISA-ADP
Assessed May 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/givanz/Vvveb/security/advisories/GHSA-xgvg-r47g-786r | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/givanz/Vvveb/releases/tag/1.0.8.2 | [email protected] | Release NotesVendor |
| https://github.com/givanz/Vvveb/security/advisories/GHSA-xgvg-r47g-786r | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/vvveb-information-disclosure-via-debug-exception-handler | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1188 | Initialization of a Resource with an Insecure Default | [email protected] |
| CWE-209 | Generation of Error Message Containing Sensitive Information | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| givanz Vvveb | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 6, 2026 | CVE Modified | CISA-ADP |
| May 6, 2026 | New CVE Received | [email protected] |