# CVE-2026-41935: Vvveb uncontrolled recursion in admin controller dispatch cycle

Source: https://junglewise.ai/threats/cve-2026-41935-vvveb-uncontrolled-recursion-in-admin-controller-dispatch-cycle  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-14. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-41935 · Severity: high · CVSS 7.1 · Published 2026-05-14

Vvveb, an open-source content management system and website builder, is vulnerable to a flaw that can crash the website. By repeatedly accessing restricted administrative pages using a low-level account, an attacker can force the server to exhaust its memory. This results in a denial-of-service, making the website unavailable to legitimate visitors and customers.

Technologies: [Givanz VvvebJs](https://junglewise.ai/threats/technologies/vvvebjs), [Vvveb](https://junglewise.ai/threats/technologies/vvveb). Vendors: [Givanz](https://junglewise.ai/threats/vendors/givanz), [Vvveb](https://junglewise.ai/threats/vendors/vvveb).

## Quick answers

**Is CVE-2026-41935 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41935 being exploited in the wild.

**How severe is CVE-2026-41935?** High severity, with a CVSS score of 7.1, published 14 May 2026.

**Which products and versions are affected?** Givanz VvvebJs before 1.0.8.3; Vvveb < 1.0.8.3.

**Is there a fix for CVE-2026-41935?** A patch was published on 2026-05-13: Version 1.0.8.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41935 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-41935?** Check whether you run Givanz VvvebJs or Vvveb at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An uncontrolled recursion vulnerability exists in the Vvveb admin controller dispatch cycle prior to version 1.0.8.3. The root cause is located in the Base::init() function, which repeatedly invokes the permission() method on error handlers when a user attempts to access forbidden URLs. This creates an infinite recursion loop that consumes PHP memory until limits are exhausted. A remote attacker with low-privileged credentials can exploit this by sending sustained requests to restricted admin paths, effectively crashing all PHP worker processes and causing a denial-of-service (DoS). The issue was addressed in version 1.0.8.3 by modifying the Error403 controller to no longer extend the vulnerable Base class.

## Affected products

- givanz Vvveb before 1.0.8.3

## Timeline

- 2026-05-13: patched: Version 1.0.8.3 released
- 2026-05-14: disclosed: Initial disclosure by VulnCheck
- 2026-05-14: advisory: CVE-2026-41935 published

## References

- [https://github.com/givanz/Vvveb/commit/c766e84b479dcf1bd1f25a44e4b9c9fa450769c8](https://github.com/givanz/Vvveb/commit/c766e84b479dcf1bd1f25a44e4b9c9fa450769c8)
- [https://github.com/givanz/Vvveb/releases/tag/1.0.8.3](https://github.com/givanz/Vvveb/releases/tag/1.0.8.3)
- [https://www.vulncheck.com/advisories/vvveb-uncontrolled-recursion-denial-of-service](https://www.vulncheck.com/advisories/vvveb-uncontrolled-recursion-denial-of-service)

## Related threats

- [Vvveb CMS authentication bypass in password reset](https://junglewise.ai/threats/cve-2026-110799-vvveb-is-a-powerful-and-easy-to-use-cms-with-page-builder-to)
- [Vvveb path traversal in backup functions](https://junglewise.ai/threats/cve-2026-112904-vvveb-is-a-powerful-and-easy-to-use-cms-with-page-builder-to)
- [Vvveb SSRF via IPv6 bypass in oEmbed proxy](https://junglewise.ai/threats/cve-2026-55232-vvveb-is-a-powerful-and-easy-to-use-cms-with-page-builder-to)
- [Vvveb CMS path traversal in sanitizeFileName](https://junglewise.ai/threats/cve-2026-55231-vvveb-is-a-powerful-and-easy-to-use-cms-with-page-builder-to)
- [Vvveb stored XSS via HTML sanitizer filter bypass](https://junglewise.ai/threats/cve-2026-55230-vvveb-is-a-powerful-and-easy-to-use-cms-with-page-builder-to)