CVE-2026-114462 Details
Description
Improper link resolution before file access ('link following') vulnerability in Velneo vServer. This issue affects vServer: from 32.3 before 36.6 and from 37.1 before 37.2.
A vulnerability in Velneo vServer's HTTP server component allows arbitrary file reading through improper link resolution before file access, commonly known as 'link following'. This issue affects vServer versions 32.3 prior to 36.6, as well as versions 37.1 prior to 37.2.
Users can update to Velneo vServer versions 36.6 or 37.2, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 21, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://velneo.es/avisos-de-seguridad/ | 6b608899-1da4-4a4d-8cfe-114101467ac1 | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-59 | Improper Link Resolution Before File Access ('Link Following') | 6b608899-1da4-4a4d-8cfe-114101467ac1 |
Affected Products
| Product | Versions |
|---|---|
| Velneo vServer | >= 32.3, < 36.6 >= 37.1, < 37.2 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 21, 2026 | New CVE Received | 6b608899-1da4-4a4d-8cfe-114101467ac1 |