Live › vulnerability › CVE-2026-114462
Go to dashboardVelneo vServer resolves symbolic links before accessing files without checking the target, so a local user can point it at files outside the intended location. The advisory does not say what can be read or written through this path.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Installations of Velneo vServer in the affected version ranges are exposed. The sources do not say which deployment modes, configurations or file paths make an install reachable, so the exact exposure is unknown. Installations already on or later, or or later, are not affected.
36.637.2No product ranges from the sources yet.
36.6, and 37.1 up to but not including 37.2.36.6 or later on the 36.x line, or to 37.2 or later on the 37.x line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper link resolution before file access ('link following') vulnerability in Velneo vServer. This issue affects vServer: from 32.3 before 36.6 and from 37.1 before 37.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-114462")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.