CVE-2026-41931: Vvveb < 1.0.8.2 Information Disclosure via Debug Exception Handler
Vvveb before version 1.0.8.2 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain sensitive server information by triggering unhandled exceptions in the password-reset module. Attackers can access the admin password-reset endpoint to trigger a fatal error caused by a missing namespace import, which exposes the absolute server file path, internal class namespaces, line numbers, and source code excerpts through the debug exception handler rendered to unauthenticated requests.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vvvebto a version that resolves this vulnerability.Fixed in 1.0.8.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41931?
CVE-2026-41931 is classified as an information disclosure vulnerability, allowing unauthorized access to sensitive server information.
How do I fix CVE-2026-41931?
To mitigate CVE-2026-41931, upgrade Vvveb to version 1.0.8.2 or later.
Who is affected by CVE-2026-41931?
CVE-2026-41931 affects all versions of Vvveb prior to 1.0.8.2.
What type of vulnerability is CVE-2026-41931?
CVE-2026-41931 is an information disclosure vulnerability caused by unhandled exceptions in the password-reset module.
Can CVE-2026-41931 be exploited remotely?
Yes, CVE-2026-41931 can be exploited by unauthenticated attackers remotely to obtain sensitive information.