CVE WATCH / VULNERABILITY DETAIL
CVE-2026-123496
LOWCVSS 3.3NVD feed
Published 8 November 2026 · tracked since 8 November 2026
Description
Vikunja veans before 2.7.1 contains a symlink following vulnerability that allows attackers to make veans init write files outside the repository via crafted repo symlinks. Attackers can ship symlinked .veans.yml, .claude, or .opencode entries to overwrite user files like ~/.bashrc or install veans
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog