CVE-2026-41935

Name of the Vulnerable Software and Affected Versions Vvveb versions prior to 1.0.8.3

Description An uncontrolled recursion issue exists in the admin controller dispatch cycle. The Base::init() function repeatedly invokes the permission() function on error handlers, leading to infinite recursion that exhausts PHP memory limits. A low-privilege user can trigger this by sending sustained requests to forbidden admin URLs, resulting in a denial of service for legitimate traffic by exhausting PHP memory across all workers.

Recommendations Update to version 1.0.8.3 or later.