EUVD-2026-78650
GHSA-p4h8-xg7f-xqrc
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 15, 2026
Authenticated users of self-hosted Vikunja instances before 2.6.0 can crash the server by uploading a highly compressed archive through the data-import feature, which is expanded without any size or expansion-ratio limit and consumes tens of gigabytes of memory and disk. The issue is a classic decompression-bomb denial of service (CWE-400) rated 7.1 under CVSS 4.0 (AV:N/AC:L/PR:L/UI:N, availability-only impact); any account able to reach the import endpoint is sufficient, no administrative rights are needed. A vendor fix is available in 2.6.0, and no public exploit code or CISA KEV listing was identified in the supplied intelligence.
Earlier versions of this analysis (1)
Vikunja versions before 2.6.0 do not bound the expansion of uploaded archives during data import, letting any authenticated user trigger a decompression bomb that balloons to tens of gigabytes in memory and disk. This uncontrolled resource consumption (CWE-400) exhausts server memory and storage, crashing the instance and denying service to all other users. No public exploit code or CISA KEV listing is associated with this CVE at time of analysis, but the attack requires only a low-privileged account and the built-in import feature, making it trivially reproducible by an insider or any user who can self-register.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Vikunja gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Network-reachable import endpoint needs only a low-privileged account and no user interaction; impact is availability-only resource exhaustion.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
Vikunja before 2.6.0 fails to limit archive expansion during data import, allowing authenticated users to cause denial of service. Attackers can upload highly compressed files that expand to tens of gigabytes in memory and disk, exhausting server resources and crashing the instance.
Technical POC Analysis
Class: uncontrolled resource consumption during archive expansion.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
A denial-of-service flaw in self-hosted Vikunja deployments (versions before 2.6.0) allows any authenticated user - with no administrative rights - to take the entire collaboration platform offline by importing a small, highly compressed file that expands into tens of gigabytes of memory and disk consumption. Because the vulnerability is triggered through the standard data-import feature, every team relying on Vikunja for task and project tracking is exposed, and a single low-privilege insider or compromised account can cause a full outage requiring manual intervention to recover. While no public exploit code or active exploitation has been identified, the low skill barrier and availability-only impact make prompt patching the prudent course.
Within 24 hours, identify all self-hosted Vikunja instances in the environment, confirm their running version, and restrict or disable access to the data-import endpoint for non-essential accounts until upgrades are complete; also review import-related logs for anomalous archive uploads. Within 7 days, upgrade every instance to Vikunja 2.6.0 (the vendor-released fix version) in a staged manner - starting with non-production, then production - and apply container resource limits (memory and disk quotas) plus import size/expansion-ratio caps as defense in depth. Within 30 days, verify via authenticated version scanning that no instance remains below 2.6.0, close out any self-registration or guest accounts that do not require import privileges, and incorporate Vikunja version checks into routine vulnerability management reporting.
Apply vendor patch (Vikunja 2.6.0).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Cross-tenant information disclosure in the self-hosted task manager Vikunja (0.24.0 through 2.3.0) lets a holder of any
Weak password policy in Vikunja task management before 2.0.0 allows users to set trivially guessable passwords. PoC avai
Principal type confusion in Vikunja (versions 0.22.0-2.3.0) allows an authenticated low-privilege attacker to fully cont
Stored cross-site scripting (XSS) in Vikunja prior to version 2.0.0 allows authenticated attackers to steal authenticati
Vikunja before version 2.0.0 contains a path traversal vulnerability in its backup restoration function that fails to va
Vikunja is an open-source self-hosted task management platform. [CVSS 6.1 MEDIUM]
Business logic vulnerability in Vikunja task management platform before 2.1.0 allows incomplete resource cleanup, potent
Instance-wide data breach in Vikunja before 2.2.1 lets remote attackers exfiltrate and destroy every file attachment acr
Vikunja's OIDC callback handler issues a full JWT to any successfully matched user without checking whether that account
Vikunja instances before 2.6.0 expose CalDAV BasicAuth endpoints (/dav, /.well-known, and /feeds) that are not covered b
Vikunja versions before 2.6.0 ship authentication endpoints under /api/v2 (login, register, password-reset, and OAuth to
Vikunja prior to 2.6.0 leaks the secret hash that backs a project's link shares through its single-share read endpoint,
Exploit-DB