CVE-2026-114462

MediumCVSS 6.0

Published: 21/10/2026(UTC)Updated: 30/10/2026(UTC)Translated: 22/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.31%

23th percentile - higher than 23% of all known CVEs

Summary

Velneo vServer contains an improper link resolution before file access ('link following') vulnerability. This issue affects vServer from 32.3 before 36.6 and from 37.1 before 37.2.

Risk Assessment

An attacker can exploit links to access files outside the intended scope, potentially leading to unauthorized data reading or modification.

Recommendation

Update Velneo vServer to version 36.6 or 37.2 (depending on the branch), which fix this vulnerability.

Other vulnerabilities in Velneo vServer

CVE-2026-114405High
An improper array index validation vulnerability in Velneo vServer affects versions from 36.0 before 36.6 and from 37.0 before 37.2. The flaw may lead to unsafe out-of-bounds memory access.

Original NVD description (English source)

Improper link resolution before file access ('link following') vulnerability in Velneo vServer. This issue affects vServer: from 32.3 before 36.6 and from 37.1 before 37.2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS