{"id":"CVE-2026-123496","title":"Vikunja veans before 2.7.1 Symlink Following in veans init","summary":"Vikunja veans before 2.7.1 contains a symlink following vulnerability that allows attackers to make veans init write files outside the repository via crafted repo symlinks. Attackers can ship symlinked .veans.yml, .claude, or .opencode e…","severity":"low","cvss":3.3,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","cvssSource":"cna","cwe":["CWE-59"],"vendor":"go-vikunja","product":"vikunja","affected":["vikunja < 2.7.1"],"published":"2026-11-08","updated":"2026-11-08","sourceUpdated":"2026-11-08T01:37:14.269Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-123496","references":[{"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-rxwp-q2qg-98vw","label":"GitHub Security Advisory (GHSA-rxwp-q2qg-98vw)"},{"url":"https://www.vulncheck.com/advisories/vikunja-veans-before-2.7.1-symlink-following-in-veans-init","label":"VulnCheck Advisory: Vikunja veans before 2.7.1 Symlink Following in veans init"}],"tags":["cve.org"],"ingestedAt":"2026-11-08T02:43:18.706Z","slug":"CVE-2026-123496","body":"## Overview\n\nVikunja veans before 2.7.1 contains a symlink following vulnerability that allows attackers to make veans init write files outside the repository via crafted repo symlinks. Attackers can ship symlinked .veans.yml, .claude, or .opencode entries to overwrite user files like ~/.bashrc or install veans hooks and plugins globally.\n\n## Affected\n\n- `vikunja < 2.7.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":18,"depthScoreParts":{"impact":18.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}