Directory Listing Information Disclosure in Vvveb by Givanz

CVE-2026-41933

What is CVE-2026-41933?

An information disclosure vulnerability exists in Vvveb versions before 1.0.8.3, which allows unauthorized users to exploit missing index directives in .htaccess files. This oversight enables attackers to gain access to sensitive directories, including admin asset paths, plugins, themes, and media folders. Malicious users can enumerate files and directories, potentially revealing filenames, file sizes, modification timestamps, and sensitive unrendered admin templates that may expose critical route maps.

References