Threats tagged 'ghsa-5mwr-g4r9-hv44'

Vikunja veans versions prior to 2.7.1 have a symlink following vulnerability that allows attackers to cause the veans init process to write files outside the intended repository. This is achieved by crafting repository symlinks that redirect writes to arbitrary user files such as ~/.bashrc or to locations that install hooks and plugins globally.