Vulnerability · Published Nov 8, 2026 · Assigned by VulnCheck
CVE-2026-123496Vikunja veans before 2.7.1 Symlink Following in veans init
Low 3.3
In plain English
A low-severity security flaw in vikunja from go-vikunja. There are no confirmed reports of exploitation so far.
Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)–no EPSS score yet
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Vikunja veans before 2.7.1 contains a symlink following vulnerability that allows attackers to make veans init write files outside the repository via crafted repo symlinks. Attackers can ship symlinked .veans.yml, .claude, or .opencode entries to overwrite user files like ~/.bashrc or install veans hooks and plugins globally.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| go-vikunja | vikunja | 0 – before 2.7.1 |
Weakness: CWE-59 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References
- GitHub Security Advisory (GHSA-rxwp-q2qg-98vw) vendor-advisory
- VulnCheck Advisory: Vikunja veans before 2.7.1 Symlink Following in veans init third-party-advisory