CVE-2026-123496

CVSS 4.8 (medium) · published 2026-11-08

Vikunja veans before 2.7.1 contains a symlink following vulnerability that allows attackers to make veans init write files outside the repository via crafted repo symlinks. Attackers can ship symlinked .veans.yml, .claude, or .opencode entries to overwrite user files like ~/.bashrc or install veans hooks and plugins globally.

Weakness: CWE-59

Source: NVD CVE-2026-123496

References

• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-rxwp-q2qg-98vw
• https://www.vulncheck.com/advisories/vikunja-veans-before-2.7.1-symlink-following-in-veans-init

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.