CVE-2026-41933

Vvveb before 1.0.8.3 contains a directory listing information disclosure vulnerability that allows unauthenticated attackers to enumerate files and directories by accessing multiple paths lacking proper index directives in .htaccess files. Attackers can access directories such as admin asset paths, plugins, themes, and media folders to view filenames, file sizes, modification timestamps, and unrendered admin templates containing sensitive route maps.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/givanz/Vvveb/commit/96ae04c5e4a295e281adc1d02d77444173653deb
https://github.com/givanz/Vvveb/releases/tag/1.0.8.3
https://www.vulncheck.com/advisories/vvveb-directory-listing-information-disclosure

Configurations

No configuration.

History

26 Oct 2026, 14:10

Type	Values Removed	Values Added
Summary		(es) Vvveb antes de 1.0.8.3 contiene una vulnerabilidad de revelación de información por listado de directorios que permite a atacantes no autenticados enumerar archivos y directorios al acceder a múltiples rutas que carecen de directivas de índice adecuadas en archivos .htaccess. Los atacantes pueden acceder a directorios como rutas de activos de administrador, complementos, temas y carpetas de medios para ver nombres de archivo, tamaños de archivo, marcas de tiempo de modificación y plantillas de administrador no renderizadas que contienen mapas de rutas sensibles.

Information

Published : 2026-05-14 15:16

Updated : 2026-10-26 14:10

NVD link : CVE-2026-41933

Mitre link : CVE-2026-41933

CVE.ORG link : CVE-2026-41933

JSON object : View

Products Affected

No product.

CWE

CWE-548

Exposure of Information Through Directory Listing

{"id": "CVE-2026-41933", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41933", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-14T15:58:49.831049Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/givanz/Vvveb", "vendor": "givanz", "product": "Vvveb", "versions": [{"status": "affected", "version": "0", "lessThan": "1.0.8.3", "versionType": "custom"}, {"status": "unaffected", "version": "96ae04c5e4a295e281adc1d02d77444173653deb", "versionType": "git"}], "packageURL": "pkg:github/givanz/Vvveb", "defaultStatus": "affected"}]}], "published": "2026-05-14T15:16:45.873", "references": [{"url": "https://github.com/givanz/Vvveb/commit/96ae04c5e4a295e281adc1d02d77444173653deb", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.3", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/vvveb-directory-listing-information-disclosure", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-548"}]}], "descriptions": [{"lang": "en", "value": "Vvveb before 1.0.8.3 contains a directory listing information disclosure vulnerability that allows unauthenticated attackers to enumerate files and directories by accessing multiple paths lacking proper index directives in .htaccess files. Attackers can access directories such as admin asset paths, plugins, themes, and media folders to view filenames, file sizes, modification timestamps, and unrendered admin templates containing sensitive route maps."}, {"lang": "es", "value": "Vvveb antes de 1.0.8.3 contiene una vulnerabilidad de revelaci\u00f3n de informaci\u00f3n por listado de directorios que permite a atacantes no autenticados enumerar archivos y directorios al acceder a m\u00faltiples rutas que carecen de directivas de \u00edndice adecuadas en archivos .htaccess. Los atacantes pueden acceder a directorios como rutas de activos de administrador, complementos, temas y carpetas de medios para ver nombres de archivo, tama\u00f1os de archivo, marcas de tiempo de modificaci\u00f3n y plantillas de administrador no renderizadas que contienen mapas de rutas sensibles."}], "lastModified": "2026-10-26T14:10:00.130", "sourceIdentifier": "disclosure@vulncheck.com"}