CVE-2026-114462: Arbitrary File Read via Symlink in Velneo vServer HTTP Server

Q: Which vServer versions are affected?

Affected releases are vServer versions from 32.3 before 36.6, and versions from 37.1 before 37.2. Versions 36.6 and 37.2 are outside the stated affected ranges.

Q: What is the impact of successful exploitation?

The vulnerability allows arbitrary file read through symlink handling in the vServer HTTP Server.

Published Oct 21, 2026

Updated

Improper link resolution before file access ('link following') vulnerability in Velneo vServer. This issue affects vServer: from 32.3 before 36.6 and from 37.1 before 37.2.

Affected Software

1 affected component

Velneo vServer>=32.3<36.6, >=37.1<37.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Velneo vServer to a version that resolves this vulnerability.
Fixed in 36.6
Upgrade
Upgrade Velneo vServer to a version that resolves this vulnerability.
Fixed in 37.2

Event History

Oct 21, 2026

CVE Published

via MITRE·03:02 PM

Data Sourced

via MITRE·03:02 PM

RemedyDescriptionWeakness

Frequently Asked Questions

Which vServer versions are affected?

Affected releases are vServer versions from 32.3 before 36.6, and versions from 37.1 before 37.2. Versions 36.6 and 37.2 are outside the stated affected ranges.

What is the impact of successful exploitation?

The vulnerability allows arbitrary file read through symlink handling in the vServer HTTP Server.

CVE-2026-114462: Arbitrary File Read via Symlink in Velneo vServer HTTP Server

Affected Software

Remediation

Event History

Frequently Asked Questions

Which vServer versions are affected?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which vServer versions are affected?

What is the impact of successful exploitation?