CVE-2026-55066

creationtimestamp| type| source ---|---|--- 2026-08-28 18:35:28+00:00| published-proof-of-concept| https://github.com/go-vikunja/vikunja/security/advisories/GHSA-5pg6-m483-7vrg...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the import process. An attacker can exhaust server storage and potentially cause service disruption by uploading compressed zip files containing files that exceed the configur...

CVE-2026-35598

creationtimestamp| type| source ---|---|--- 2026-04-09 21:44:59+00:00| published-proof-of-concept| https://github.com/go-vikunja/vikunja/security/advisories/GHSA-48ch-p4gq-x46x...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the RemoveProjectBackground process. An attacker can permanently delete background images by sending a DELETE request to the relevant API endpoint with only read-level permissions. Remediation Upgrade...

CVE-2026-27819: Improper Limitation of a Pathname to a Restricted Directory

Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the restoreConfig function in vikunja/pkg/modules/dump/restore.go of the go-vikunja/vikunja repository fails to sanitize file paths within the provided ZIP archive. A maliciously crafted ZIP can bypass the...