{"id":"CVE-2026-114462","kind":"vulnerability","aliases":["CVE-2026-114462"],"related":[],"title":"Velneo vServer: link following lets local users reach unintended files","description":"Improper link resolution before file access ('link following') vulnerability in Velneo vServer. This issue affects vServer: from 32.3 before 36.6 and from 37.1 before 37.2.","summary":"Velneo vServer resolves symbolic links before accessing files without checking the target, so a local user can point it at files outside the intended location. The advisory does not say what can be read or written through this path.","severity":"medium","cvss":6.0,"epss":0.00305,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["low-level-file-access","other","velneo","vserver"],"not_affected_if":["already-patched-version"],"how_to_check":"- Check the installed vServer version against the affected ranges: 32.3 up to but not including `36.6`, and 37.1 up to but not including `37.2`.\n- unknown for other checks; the sources do not describe file paths or configuration that expose it.","fix":"- Upgrade vServer to `36.6` or later on the 36.x line, or to `37.2` or later on the 37.x line.","status":"open","published_at":"2026-10-21T16:17:33+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T04:05:30+00:00","updated_at":"2026-10-25T04:05:30+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-25T04:05:30Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade vServer to `36.6` or later on the 36.x line, or to `37.2` or later on the 37.x line.","reach":"local","title":"Velneo vServer: link following lets local users reach unintended files","impact":"medium","summary":"Velneo vServer resolves symbolic links before accessing files without checking the target, so a local user can point it at files outside the intended location. The advisory does not say what can be read or written through this path.","category":"other","nicknames":[],"who_cares":["velneo","vserver","low-level-file-access"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown file access through symbolic links on the server","analyst_note":"Check the Velneo advisory for which files are reachable, whether a local account is required, and any workaround, since the NVD entry gives only the affected ranges.","how_to_check":"- Check the installed vServer version against the affected ranges: 32.3 up to but not including `36.6`, and 37.1 up to but not including `37.2`.\n- unknown for other checks; the sources do not describe file paths or configuration that expose it.","needs_analyst":true,"not_affected_if":["already-patched-version"],"who_is_affected":"Installations of Velneo vServer in the affected version ranges are exposed. The sources do not say which deployment modes, configurations or file paths make an install reachable, so the exact exposure is unknown. Installations already on `36.6` or later, or `37.2` or later, are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000601,"input_tokens":3311,"output_tokens":539,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114462':13A,16A '-2026':12A,15A '32.3':81C '36.6':83C '37.1':86C '37.2':88C 'access':21B,31B,69C 'advisori':51B 'affect':78C 'check':34B 'cve':11A,14A 'file':10A,20B,32B,45B,68C 'follow':4A,71C 'improp':64C 'intend':48B 'issu':77C 'let':5A 'level':19B 'link':3A,29B,65C,70C 'local':6A,39B 'locat':49B 'low':18B 'low-level-file-access':17B 'outsid':46B 'path':63B 'point':42B 'reach':8A 'read':58B 'resolut':66C 'resolv':27B 'say':54B 'symbol':28B 'target':36B 'unintend':9A 'user':7A,40B 'velneo':1A,23B,25B,74C 'vserver':2A,24B,26B,75C,79C 'vulner':72C 'without':33B 'written':60B","nicknames":[],"mitigations":[],"who_affected":"Installations of Velneo vServer in the affected version ranges are exposed. The sources do not say which deployment modes, configurations or file paths make an install reachable, so the exact exposure is unknown. Installations already on `36.6` or later, or `37.2` or later, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T16:17:33+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"6b608899-1da4-4a4d-8cfe-114101467ac1","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114462","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114462","severity":null,"published_at":"2026-10-21T16:17:33+00:00","modified_at":"2026-10-22T15:38:50+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114462","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114462","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}