CVE-2026-123496
Deferred Deferred - Pending Action

Vikunja Veans Symlink Following Vulnerability Before 2.7.1

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
Vikunja veans before 2.7.1 contains a symlink following vulnerability that allows attackers to make veans init write files outside the repository via crafted repo symlinks. Attackers can ship symlinked .veans.yml, .claude, or .opencode entries to overwrite user files like ~/.bashrc or install veans hooks and plugins globally.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-123496
EUVD
EUVD-2026-119381

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vikunja veans to 2.7.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Vikunja veans versions before 2.7.1. It involves a symlink following issue in the veans init component where attackers can craft repository symlinks to make veans init write files outside the intended directory. This could overwrite user files like ~/.bashrc or install global hooks and plugins.

Detection Guidance

Check for vulnerable Vikunja veans versions before 2.7.1 by running: veans version. If output shows a version below 2.7.1, the system is affected. Inspect repository directories for suspicious symlinks in .veans.yml, .claude, or .opencode files that point outside the repo.

Impact Analysis

The impact includes loss of user files such as ~/.bashrc, installation of malicious global hooks in ~/.claude, or global plugin installations. Attackers could overwrite critical user files or execute unauthorized code globally.

Mitigation Strategies

Upgrade Vikunja veans to version 2.7.1 or later immediately. Avoid using veans init in untrusted repositories. Review and remove any suspicious symlinks in project directories. Monitor for unexpected file changes in user home directories like ~/.bashrc.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123496. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...