CVE-2026-39918 describes a code injection vulnerability in givanz Vvveb before version 1.0.8.1. The vulnerability exists because the installation endpoint takes the subdir POST parameter and writes it directly into the env.php configuration file without validation or escaping. Attackers can break out of the string context in the define statement to inject arbitrary PHP code. This results in unauthenticated remote code execution with the privileges of the web server user. The CVSS 4.0 base score is 9.2, reflecting a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary PHP code on the affected system with the web server's privileges. This can lead to full compromise of the application and potentially the underlying server environment.

No official patch or remediation is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the installation endpoint and avoid exposing it to untrusted networks. Monitor for vendor updates regarding a security patch.