EUVD-2026-119395

Vikunja before 2.7.1 fails to re-anchor PluginsDir and LogPath to service.rootpath, allowing plugins to load from and logs to be written in the startup working directory. Local attackers able to write to that directory can plant plugins loaded into the server when plugins are enabled, or read...

CVE-2026-123510

Vikunja versions before 2.7.1 are vulnerable to an uncontrolled search path issue because the PluginsDir and LogPath are not anchored to the service.rootpath . This flaw allows plugins to be loaded from and logs to be written in the startup working directory. A local attacker with write access to...

CVE-2026-123510 Vikunja before 2.7.1 Plugin and Log Directories Not Anchored to Rootpath

Vikunja before 2.7.1 fails to re-anchor PluginsDir and LogPath to service.rootpath, allowing plugins to load from and logs to be written in the startup working directory. Local attackers able to write to that directory can plant plugins loaded into the server when plugins are enabled, or read...

PT-2026-139791

Vikunja before 2.7.1 fails to re-anchor PluginsDir and LogPath to service.rootpath, allowing plugins to load from and logs to be written in the startup working directory. Local attackers able to write to that directory can plant plugins loaded into the server when plugins are enabled, or read...

CVE-2026-123510: go-vikunja vikunja: Vikunja before 2.7.1 fails to re-anchor PluginsDir and LogPath to service.rootpath, allowing plugins to load from and…

Vikunja before 2.7.1 fails to re-anchor PluginsDir and LogPath to service.rootpath, allowing plugins to load from and logs to be written in the startup working directory. Local attackers able to write to that directory can plant plugins loaded into the server when plugins are enabled, or read...