Denial-of-service (DoS)

code.vikunja.io/api is vulnerable to a denial-of-service DoS. The vulnerability is due to missing pixel count restrictions on avatar and project-background uploads, which allows an authenticated attacker to upload crafted images with extreme aspect ratios that consume excessive CPU and memory,...