Velneo vServer contains a flaw in its link resolution logic that allows an attacker to manipulate an HTTP request to reference a symbolic link pointing to a file outside the intended document root, causing the server to read and return the content of that file. The vulnerability is classified as CWE-59, which affects confidentiality by exposing arbitrary local files to an attacker. Based on the description, it is inferred that the vulnerability requires that the application processes user-supplied file paths in the request; exploitation can then be triggered via that HTTP request, turning it into a vector for file disclosure.

The issue is present in Velneo vServer versions 32.3 through 36.5 and in 37.1 through 37.1. Any deployment running these affected releases is vulnerable. Velneo has released mitigations in vServer 36.6 and 37.2 which correctly restrict symbolic link traversal. Clients using the older releases must consult the vendor advisory for upgrade guidance.

The CVSS score of 6 indicates a moderate risk; however, since the vulnerability can be triggered via a standard HTTP request and requires no special privileges, the potential adversaries are not limited to privileged users. The EPSS score is not available, and the flaw is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation at this time. Nevertheless, the combination of remote triggerability and the ability to read arbitrary files makes it a significant threat if not remediated promptly.