CVE-2026-33675

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the migration helper functions "DownloadFile" and "DownloadFileWithHeaders" in "pkg/modules/migration/helpers.go" make arbitrary HTTP GET requests without any SSRF protection. When a user triggers a Todoist or...

CVE-2026-33675: Server-Side Request Forgery (SSRF)

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the migration helper functions DownloadFile and DownloadFileWithHeaders in pkg/modules/migration/helpers.go make arbitrary HTTP GET requests without any SSRF protection. When a user triggers a Todoist or Trell...