CVE-2026-123496
LOW
NVD
CVSS Score
3.3
Severity
LOW
Published
Nov 08, 2026
Vendor
unknown
Description
Vikunja veans before 2.7.1 contains a symlink following vulnerability that allows attackers to make veans init write files outside the repository via crafted repo symlinks. Attackers can ship symlinked .veans.yml, .claude, or .opencode entries to overwrite user files like ~/.bashrc or install veans hooks and plugins globally.