Low severity3.3NVD Advisory· Published Nov 8, 2026· Updated Nov 8, 2026

CVE-2026-123496

Description

Vikunja veans before 2.7.1 contains a symlink following vulnerability that allows attackers to make veans init write files outside the repository via crafted repo symlinks. Attackers can ship symlinked .veans.yml, .claude, or .opencode entries to overwrite user files like ~/.bashrc or install veans hooks and plugins globally.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Go Vikunja/Vikunjallm-fuzzy
Range: <2.7.1

Patches

Vulnerability mechanics

References

github.com/go-vikunja/vikunja/security/advisories/GHSA-rxwp-q2qg-98vwnvd
www.vulncheck.com/advisories/vikunja-veans-before-2.7.1-symlink-following-in-veans-initnvd

News mentions

No linked articles in our index yet.

cvss	0.214
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000