---
id: "CVE-2026-114462"
kind: "vulnerability"
aliases: ["CVE-2026-114462"]
title: "Velneo vServer: link following lets local users reach unintended files"
severity: "medium"
cvss: 6.0
epss: 0.00305
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["low-level-file-access", "other", "velneo", "vserver"]
not_affected_if: ["already-patched-version"]
published_at: "2026-10-21T16:17:33+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-25T04:05:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114462", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114462", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Velneo vServer: link following lets local users reach unintended files

Velneo vServer resolves symbolic links before accessing files without checking the target, so a local user can point it at files outside the intended location. The advisory does not say what can be read or written through this path.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed vServer version against the affected ranges: 32.3 up to but not including `36.6`, and 37.1 up to but not including `37.2`.
- unknown for other checks; the sources do not describe file paths or configuration that expose it.

## Fix

- Upgrade vServer to `36.6` or later on the 36.x line, or to `37.2` or later on the 37.x line.

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114462
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114462

## From the sources

Improper link resolution before file access ('link following') vulnerability in Velneo vServer. This issue affects vServer: from 32.3 before 36.6 and from 37.1 before 37.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_