Information Disclosure Vulnerability in Vvveb Product by Givanz

CVE-2026-41931

What is CVE-2026-41931?

Earlier versions of Vvveb prior to 1.0.8.2 are susceptible to an information disclosure vulnerability. This flaw permits attackers, without authentication, to retrieve sensitive server data via unhandled exceptions in the password-reset module. By accessing the admin password-reset endpoint, attackers can cause fatal errors due to a missing namespace import, revealing critical details such as the server's absolute file path, internal class namespaces, and even snippets of source code through the debug exception handler. This vulnerability poses a significant risk to server integrity and confidentiality.

References