CVE-2026-35602

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the Vikunja file import endpoint uses the attacker-controlled Size field from the JSON metadata inside the import zip instead of the actual decompressed file content length for the file size enforcement check. By setting Size to 0 in the JSON while including large compressed file entries in the zip, an attacker bypasses the configured maximum file size limit. This vulnerability is fixed in 2.3.0.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/go-vikunja/vikunja/pull/2575	Issue Tracking
https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0	Release Notes
https://github.com/go-vikunja/vikunja/security/advisories/GHSA-qh78-rvg3-cv54	Exploit Vendor Advisory
https://github.com/go-vikunja/vikunja/security/advisories/GHSA-qh78-rvg3-cv54	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Vikunja es una plataforma de gestión de tareas de código abierto y autoalojada. Antes de 2.3.0, el endpoint de importación de archivos de Vikunja utiliza el campo ’Size’ controlado por el atacante de los metadatos JSON dentro del archivo zip de importación en lugar de la longitud real del contenido del archivo descomprimido para la comprobación de cumplimiento del tamaño del archivo. Al establecer ’Size’ en 0 en el JSON mientras se incluyen entradas de archivos comprimidos grandes en el zip, un atacante omite el límite máximo de tamaño de archivo configurado. Esta vulnerabilidad se corrigió en 2.3.0.

Information

Published : 2026-04-10 17:17

Updated : 2026-10-26 21:10

NVD link : CVE-2026-35602

Mitre link : CVE-2026-35602

CVE.ORG link : CVE-2026-35602

JSON object : View

Products Affected

vikunja

vikunja

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-35602", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35602", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-14T14:19:25.945976Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "go-vikunja", "product": "vikunja", "versions": [{"status": "affected", "version": "< 2.3.0"}]}]}], "published": "2026-04-10T17:17:03.993", "references": [{"url": "https://github.com/go-vikunja/vikunja/pull/2575", "tags": ["Issue Tracking"], "source": "security-advisories@github.com"}, {"url": "https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-qh78-rvg3-cv54", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-qh78-rvg3-cv54", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the Vikunja file import endpoint uses the attacker-controlled Size field from the JSON metadata inside the import zip instead of the actual decompressed file content length for the file size enforcement check. By setting Size to 0 in the JSON while including large compressed file entries in the zip, an attacker bypasses the configured maximum file size limit. This vulnerability is fixed in 2.3.0."}, {"lang": "es", "value": "Vikunja es una plataforma de gesti\u00f3n de tareas de c\u00f3digo abierto y autoalojada. Antes de 2.3.0, el endpoint de importaci\u00f3n de archivos de Vikunja utiliza el campo \u2019Size\u2019 controlado por el atacante de los metadatos JSON dentro del archivo zip de importaci\u00f3n en lugar de la longitud real del contenido del archivo descomprimido para la comprobaci\u00f3n de cumplimiento del tama\u00f1o del archivo. Al establecer \u2019Size\u2019 en 0 en el JSON mientras se incluyen entradas de archivos comprimidos grandes en el zip, un atacante omite el l\u00edmite m\u00e1ximo de tama\u00f1o de archivo configurado. Esta vulnerabilidad se corrigi\u00f3 en 2.3.0."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CC8B46CF-6E7B-46F4-8275-D1A38F2A6D5E", "versionEndExcluding": "2.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}