CVE-2026-123496

The Vikunja veans component, prior to version 2.7.1 , is vulnerable to a symlink following issue during the veans init process. An attacker can exploit this by providing crafted repository symlinks to force the initialization process to write files outside the intended repository directory. This ...