Vulnerability · Published May 14, 2026 · Assigned by VulnCheck

CVE-2026-41933Vvveb < 1.0.8.3 Directory Listing Information Disclosure

Medium 5.3

In plain English

A medium-severity security flaw in Vvveb from givanz. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.2%top 83.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Vvveb before 1.0.8.3 contains a directory listing information disclosure vulnerability that allows unauthenticated attackers to enumerate files and directories by accessing multiple paths lacking proper index directives in .htaccess files. Attackers can access directories such as admin asset paths, plugins, themes, and media folders to view filenames, file sizes, modification timestamps, and unrendered admin templates containing sensitive route maps.

Affected products (as reported)

Vendor	Product	Versions
givanz	Vvveb	0 – before 1.0.8.3

Weakness: CWE-548 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/givanz/Vvveb/releases/tag/1.0.8.3 release-notes
https://github.com/givanz/Vvveb/commit/96ae04c5e4a295e281adc1d02d77444173653deb patch
https://www.vulncheck.com/advisories/vvveb-directory-listing-information-disclosure third-party-advisory