CVE-2026-39918 is a code injection vulnerability (CWE-94) in givanz Vvveb prior to version 1.0.8.1. The issue exists in the installation endpoint where the subdir POST parameter is unsafely written into the env.php configuration file without escaping or validation. This improper control of code generation allows attackers to inject arbitrary PHP code by escaping the string context in the define statement, resulting in unauthenticated remote code execution as the web server user. The vulnerability is remotely exploitable without authentication and has a CVSS 4.0 score of 9.2, reflecting its critical impact.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary PHP code on the affected server with the privileges of the web server user. This can lead to full system compromise, data theft, or service disruption. The vulnerability is critical due to its ease of exploitation (no authentication required) and the high impact of remote code execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid exposing the installation endpoint to untrusted networks and consider implementing web application firewall (WAF) rules to detect and block attempts to exploit this vulnerability. Monitor vendor channels for updates and apply patches promptly once available.