Vikunja veans before version 2.7.1 contains a symlink following vulnerability that allows an attacker to make veans init write files outside the repository via crafted repository symlinks. This permits overwriting arbitrary files such as ~/.bashrc or installing global veans hooks and plugins, thereby compromising file integrity and potentially enabling execution of malicious code. The weakness is classified as an arbitrary file write (CWE‑59).

The vulnerability affects the Vikunja application (go‑vikunja:vikunja) running any version prior to 2.7.1. Users who rely on older releases are susceptible to this flaw unless they upgrade.

The CVSS score of 4.8 indicates moderate severity, and the EPSS score is not available, which means current exploitation likelihood is unclear. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this flaw by providing a repository that contains specially crafted symlinks during the init phase; the exploit requires write access to a repository that veans init can process, and an attacker may then inject their own files into the user’s environment.