Vvveb before version 1.0.8.2 contains a flaw in the debug exception handling that discloses server information when an unhandled exception is triggered. The vulnerability is activated by sending a request to the admin password‑reset endpoint, causing a fatal error due to a missing namespace import. The default debug handler renders the exception details to any unauthenticated user, exposing absolute file paths, internal class namespaces, line numbers, and code excerpts. The result is a classic information‑disclosure scenario that gives attackers insight into the application’s structure and environment.

The vulnerable system is the Vvveb content management system from the vendor givanz. All installations using a version older than release 1.0.8.2 are susceptible. The vulnerability specifically involves the password‑reset module and any publicly exposed admin endpoints that invoke it.

The CVSS score of 6.9 indicates moderate severity. Attackers can exploit this flaw via unauthenticated HTTP requests to the password‑reset endpoint, which is typically accessible over the web. No privileged access is required, so the risk is broadened to any user with network connectivity. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog, but these factors do not diminish the potential impact of the disclosed information.