CVE-2026-41935

Executive Summary

CVE-2026-41935 is a high-severity (CVSS 7.1) uncontrolled recursion vulnerability in the Vvveb content management system, affecting versions prior to 1.0.8.3. The flaw resides in the admin controller dispatch cycle, where the Base::init() method repeatedly invokes permission() on error handlers, leading to infinite recursion. This recursion exhausts PHP memory limits, causing a denial of service (DoS) condition. An authenticated attacker with low privileges can exploit this by sending sustained requests to forbidden admin URLs, effectively consuming PHP memory on all workers and blocking legitimate traffic. No public exploit code or proof-of-concept is currently available, and the vendor has released a patch in version 1.0.8.3.

Supply Chain & Package Security

Vvveb is a PHP-based CMS distributed via GitHub and its official website. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby), but the supply chain risk is moderate. Organizations using Vvveb should verify they are running version 1.0.8.3 or later, as older versions are directly vulnerable. No malicious packages or compromised dependencies have been reported in relation to this CVE.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
• Base Score: 7.1 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – attacker needs a valid low-privilege account
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H) – complete denial of service

Threat Level: High. The vulnerability is easy to exploit (low complexity, no user interaction) and can be triggered repeatedly to exhaust server resources. While it requires authentication, low-privilege accounts are common in multi-tenant or user-registration scenarios.

Deep Dive & Mechanics

The vulnerability is rooted in the admin controller dispatch cycle of Vvveb. When a low-privilege user attempts to access a forbidden admin URL (e.g., /admin/settings), the system’s error handler is invoked. Inside Base::init(), the permission() method is called to check access rights. However, due to a logic flaw, if the permission check fails, the error handler re-invokes Base::init(), which again calls permission(), creating an infinite recursion loop.

Technical Flow:

1. User sends request to /admin/settings (forbidden for low-privilege users).
2. Router dispatches to Base::init().
3. Base::init() calls permission() to verify access.
4. permission() returns false (access denied).
5. Error handler is triggered, which calls Base::init() again.
6. Step 3-5 repeats indefinitely, consuming PHP memory until memory_limit is exhausted.

Impact: Each request consumes PHP memory until the process crashes. An attacker can send multiple concurrent requests to exhaust all PHP-FPM workers, causing a complete denial of service for legitimate users.

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.0.8.3):

class Base {
    public function init() {
        if (!$this->permission()) {
            $this->errorHandler(); // Calls init() again
        }
    }
    
    public function permission() {
        // Check user permissions
        return false; // Forbidden
    }
    
    public function errorHandler() {
        $this->init(); // Recursive call
    }
}

Patched Code (1.0.8.3):

class Base {
    private $recursionGuard = false;
    
    public function init() {
        if ($this->recursionGuard) {
            return; // Prevent recursion
        }
        $this->recursionGuard = true;
        
        if (!$this->permission()) {
            $this->errorHandler(); // Now safe
        }
        
        $this->recursionGuard = false;
    }
    
    public function permission() {
        // Check user permissions
        return false;
    }
    
    public function errorHandler() {
        // Handle error without calling init()
        http_response_code(403);
        echo "Access Denied";
        exit;
    }
}

The patch introduces a recursion guard flag and modifies the error handler to terminate execution instead of re-invoking init().

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Valid low-privilege account on Vvveb (e.g., subscriber or editor role).
• Network access to the Vvveb admin interface.

Exploitation Steps:

1. Authenticate and obtain a session cookie.
2. Identify forbidden admin URLs (e.g., /admin/settings, /admin/users, /admin/plugins).
3. Send sustained concurrent requests to these URLs using a tool like curl or wrk.

Example Command:

# Send 100 concurrent requests to exhaust PHP memory
for i in {1..100}; do
    curl -s -o /dev/null -b "session=YOUR_SESSION_COOKIE" \
    "http://target.com/admin/settings" &
done
wait

Expected Outcome: PHP-FPM workers become unresponsive, and legitimate users receive 503 Service Unavailable errors.

Blue Team (Defense & Detection)

Detection:

• Monitor PHP-FPM error logs for Allowed memory size exhausted errors.
• Track HTTP 403 responses to admin URLs from low-privilege users.
• Use WAF rules to rate-limit requests to admin endpoints.

Mitigation:

• Immediately upgrade to Vvveb 1.0.8.3 or later.
• Implement rate limiting on admin login and admin URL access.
• Restrict admin access to trusted IP ranges where possible.

Indicators of Compromise (IOCs)

• Log Entries:
  • PHP error logs: PHP Fatal error: Allowed memory size of X bytes exhausted
  • Web server logs: Repeated HTTP 403 responses to /admin/* from same user/IP
• Network Patterns:
  • High volume of requests to /admin/settings, /admin/users, etc. from a single session
• System Impact:
  • PHP-FPM workers consuming 100% memory
  • 503 Service Unavailable errors for legitimate users

Detection Engineering

YARA Rule

rule CVE_2026_41935_Vvveb_Recursion {
    meta:
        description = "Detects Vvveb source code vulnerable to CVE-2026-41935 uncontrolled recursion"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-41935"
    strings:
        $recursive_call = "->init()" nocase
        $permission_call = "->permission()" nocase
        $error_handler = "errorHandler" nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2026-41935 Vvveb Admin Recursion DoS
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects repeated 403 responses to Vvveb admin URLs from low-privilege users, indicating potential exploitation of CVE-2026-41935
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-stem|startswith: '/admin/'
        sc-status: 403
    condition: selection | count() by src_ip > 50 within 60s
falsepositives:
    - Legitimate users repeatedly accessing forbidden admin pages
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-41935 Vvveb Admin Recursion DoS Attempt";
    flow:to_server,established;
    content:"/admin/"; http_uri;
    http_stat_code:403;
    threshold: type both, track by_src, count 50, seconds 60;
    classtype:attempted-dos;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Vvveb to version 1.0.8.3 or later. This is the only complete fix.
2. Apply WAF rules to rate-limit requests to /admin/* endpoints.
3. Monitor PHP error logs for memory exhaustion errors.

Long-term Hardening:

• Implement IP whitelisting for admin interfaces.
• Use a Web Application Firewall (WAF) with bot detection.
• Regularly audit user accounts and remove unused low-privilege accounts.
• Enable PHP max_execution_time and max_input_time to limit resource consumption.

Workarounds (if patching is delayed):

• Modify the Base.php file to add a recursion guard (as shown in the patched code).
• Disable admin access for low-privilege roles via .htaccess or Nginx configuration.

Valters IT