Vulnerability · Published May 6, 2026 · Assigned by VulnCheck

CVE-2026-41931Vvveb < 1.0.8.2 Information Disclosure via Debug Exception Handler

Medium 5.3

In plain English

A medium-severity security flaw in Vvveb from givanz. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.3%top 74.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Vvveb before version 1.0.8.2 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain sensitive server information by triggering unhandled exceptions in the password-reset module. Attackers can access the admin password-reset endpoint to trigger a fatal error caused by a missing namespace import, which exposes the absolute server file path, internal class namespaces, line numbers, and source code excerpts through the debug exception handler rendered to unauthenticated requests.

Affected products (as reported)

Vendor	Product	Versions
givanz	Vvveb	0 – before 1.0.8.2

Weakness: CWE-1188, CWE-209 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/givanz/Vvveb/releases/tag/1.0.8.2 release-notes
https://github.com/givanz/Vvveb/security/advisories/GHSA-xgvg-r47g-786r vendor-advisory
https://www.vulncheck.com/advisories/vvveb-information-disclosure-via-debug-exception-handler third-party-advisory