CVE-2026-35602

Summary: CVE-2026-35602 affects Vikunja prior to v2.3.0, where the file import endpoint uses the attacker-controlled Size from the JSON metadata instead of the decompressed file length to enforce max file size, allowing an attacker to bypass the limit by setting Size to 0. This leads to potential...

CVE-2026-27819

Vikunja prior to 2.0.0 contains a path traversal vulnerability in the CLI restore path. The restore.go logic in go-vikunja/vikunja uses the ZIP entry’s Name directly in os.OpenFile calls without validating paths, allowing a malicious ZIP to escape the intended extraction directory and overwrite a...