MEDIUM 4.8 NVD
CVE-2026-123496
Vikunja veans before 2.7.1 contains a symlink following vulnerability that allows attackers to make veans init write files outside the repository via crafted re
Vikunja veans before 2.7.1 contains a symlink following vulnerability that allows attackers to make veans init write files outside the repository via crafted repo symlinks. Attackers can ship symlinked .veans.yml, .claude, or .opencode entries to overwrite user files like ~/.bashrc or install veans hooks and plugins globally.
References
- https://github.com/go-vikunja/vikunja/security/advisories/GHSA-rxwp-q2qg-98vw
- https://www.vulncheck.com/advisories/vikunja-veans-before-2.7.1-symlink-following-in-veans
This medium severity vulnerability with a CVSS score of 4.8 was published on 2026-11-08 via NVD.
vulnfeed aggregates 16937 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.