This vulnerability allows an attacker to inject arbitrary PHP code via the subdir POST parameter in the Vvveb installation endpoint. Because the parameter is written unsanitized into the env.php file, attackers can break out of a string literal and define malicious code, enabling unauthenticated remote code execution as the web‑server user. The flaw represents a classic code‑injection weakness (CWE‑94) that can be leveraged to compromise the entire application and the underlying operating system.

The affected product is Vvveb from givanz, versions prior to 1.0.8.1. Any deployment running a version older than 1.0.8.1 that has the installation endpoint exposed is susceptible to exploitation.

The CVSS score of 9.2 signals a high severity flaw with full compromise potential. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, so current exploitation evidence is lacking, but the attack path is straightforward: an unauthenticated user can send an HTTP POST to the installation endpoint with a crafted subdir value, injecting malicious PHP into env.php and achieving remote code execution as the web‑server process. The likely attack vector is a simple HTTP request to a publicly accessible installation URL without authentication.