CVE-2026-41933 describes an information disclosure vulnerability in givanz Vvveb prior to version 1.0.8.3. The issue arises from directory listing being enabled on multiple paths due to missing or incorrect index directives in .htaccess files. This allows unauthenticated attackers to access directory contents including admin asset paths, plugins, themes, and media folders. The disclosed information includes filenames, file sizes, modification timestamps, and unrendered admin templates containing sensitive route maps. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. No patch or official remediation level is documented, and the product is not a cloud service, so remediation depends on vendor updates or user configuration changes.

The vulnerability allows unauthenticated attackers to enumerate directory contents and gain information about the file structure and sensitive files within the Vvveb installation. This information disclosure could aid attackers in planning further attacks or reconnaissance but does not directly allow code execution or privilege escalation. The impact is limited to information exposure of filenames, timestamps, and unrendered templates.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix, users should consider manually disabling directory listing by ensuring proper index directives are set in .htaccess files or web server configurations to prevent directory enumeration. Monitoring vendor channels for updates or patches is recommended.