CVE-2026-41933 describes an information disclosure vulnerability in givanz Vvveb prior to version 1.0.8.3. The issue arises from missing or misconfigured index directives in .htaccess files, enabling unauthenticated attackers to perform directory listing on multiple paths. This allows attackers to view filenames, file sizes, modification timestamps, and unrendered admin templates containing sensitive route information. No official remediation or patch information is provided in the available data.

Attackers can enumerate files and directories without authentication, potentially gaining insight into the structure and contents of the application, including sensitive admin templates and route maps. This information disclosure could aid further attacks or reconnaissance but does not directly indicate remote code execution or privilege escalation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict directory listing on affected paths by configuring proper index directives in .htaccess files or web server settings to prevent unauthorized directory enumeration.