---
id: CVE-2026-123496
title: Vikunja veans before 2.7.1 Symlink Following in veans init
summary: >-
  Vikunja veans before 2.7.1 contains a symlink following vulnerability that
  allows attackers to make veans init write files outside the repository via
  crafted repo symlinks. Attackers can ship symlinked .veans.yml, .claude, or
  .opencode e…
severity: low
cvss: 3.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-59
vendor: go-vikunja
product: vikunja
affected:
  - vikunja < 2.7.1
published: '2026-11-08'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T01:37:14.269Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-123496'
references:
  - url: >-
      https://github.com/go-vikunja/vikunja/security/advisories/GHSA-rxwp-q2qg-98vw
    label: GitHub Security Advisory (GHSA-rxwp-q2qg-98vw)
  - url: >-
      https://www.vulncheck.com/advisories/vikunja-veans-before-2.7.1-symlink-following-in-veans-init
    label: >-
      VulnCheck Advisory: Vikunja veans before 2.7.1 Symlink Following in veans
      init
tags:
  - cve.org
ingestedAt: '2026-11-08T02:43:18.706Z'
---

## Overview

Vikunja veans before 2.7.1 contains a symlink following vulnerability that allows attackers to make veans init write files outside the repository via crafted repo symlinks. Attackers can ship symlinked .veans.yml, .claude, or .opencode entries to overwrite user files like ~/.bashrc or install veans hooks and plugins globally.

## Affected

- `vikunja < 2.7.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.