Velneo vServer EUVD-2026-107308

Exploitation requires an authenticated account with at least low privileges on the Velneo vServer (CVSS PR:L) and requires meeting a specific attack precondition (CVSS AT:P) consistent with a symlink/link-following race - the attacker must induce a server-side file access that resolves an attacker-influenced symbolic link. Limiting factors: prior authentication is needed (not remote-unauthenticated), the AT:P precondition reduces reliability, and impact is confined to confidentiality (file-content disclosure) with no integrity or availability effect. Only vServer versions from 32.3 up to (not including) 36.6 and from 37.1 up to (not including) 37.2 are affected.

This is a moderate-severity information-disclosure flaw (vendor CVSS 4.0 base 6.0) in Velneo vServer, caused by improper link resolution before file access (CWE-59, symlink following). The only provided vector is CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N: network-reachable but requiring existing low privileges (PR:L) and a present attack requirement (AT:P), with impact limited to high confidentiality loss and no integrity or availability effect. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The AT:P metric signals a race/timing condition or specific precondition rather than trivial exploitation, which lowers realistic likelihood below what the network vector alone might suggest. Net assessment: a credible but non-urgent issue - authentication plus a non-trivial attack requirement plus confidentiality-only impact make this a patch-on-normal-cycle item rather than an emergency, reinforced by Velneo's limited deployment footprint. No conflicting signals were found, but note the input supplies only a CVSS 4.0 vector (no CVSS 3.1 vector and no EPSS), so prioritization rests on the vendor-reported vector alone.

An authenticated low-privileged user on a Velneo vServer instance plants or redirects a symbolic link so that a server-side file operation resolves the link and reads a file outside the user's intended scope, disclosing its contents. Success depends on satisfying a timing/precondition window (AT:P), so exploitation is possible but not reliable on every attempt. No public exploit code is known at time of analysis.