CVE-2026-41933 describes an information disclosure vulnerability in givanz Vvveb prior to version 1.0.8.3. The issue arises from missing or misconfigured .htaccess index directives that permit directory listing. Unauthenticated attackers can access multiple directories such as admin assets, plugins, themes, and media folders to enumerate filenames, file sizes, modification timestamps, and unrendered admin templates containing sensitive route maps. This exposure can aid attackers in reconnaissance but does not directly allow code execution or privilege escalation. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality.

The vulnerability allows unauthenticated attackers to gather information about the file structure and contents of certain directories within Vvveb installations. This information disclosure can facilitate further attacks by revealing sensitive files and route maps. However, the vulnerability does not directly enable system compromise or data modification. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider manually disabling directory listing on affected directories by configuring proper .htaccess index directives or web server settings to prevent directory enumeration.