Vvveb before version 1.0.8.3 is susceptible to directory listing information disclosure. The absence of proper index directives in .htaccess files allows unauthenticated attackers to access multiple directories, revealing file names, sizes, modification times, and even unrendered admin templates that contain sensitive route information. This flaw primarily results in a confidentiality breach, exposing internal structure and potential configuration details of the application.

The affected product is Vvveb, versions earlier than 1.0.8.3. Attackers can enumerate directories such as admin asset paths, plugins, themes, and media folders, which may contain code and data critical to the application’s operation.

The CVSS score of 6.9 indicates medium to high risk. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog. Because the flaw is exploitable without authentication and can be triggered via standard HTTP requests to publicly accessible URLs, the likely attack vector is remote over the web. An attacker may simply access exposed paths to gather sensitive information.