CVE-2026-123510 · Package
NO FIX YET · SEE WHAT TO DO
Vikunja before 2.7.1 does not anchor its plugin directory and log file path to the configured root path, so it uses the startup working directory instead. A local user who can write to that directory can plant a plugin that the server loads, or read misplaced logs including audit.log.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that self-host Vikunja before 2.7.1 and run it where a local user or process can write to the directory the service starts from. Plugin loading only matters if plugins are enabled. Instances started from a directory only administrators can write to are much less exposed.
Not affected if locked-working-directory, managed-hosting, plugins-disabled
Who cares linux, self-hosted, vikunja
2.7.1.2.7.1 or later.Vikunja before 2.7.1 fails to re-anchor PluginsDir and LogPath to service.rootpath, allowing plugins to load from and logs to be written in the startup working directory. Local attackers able to write to that directory can plant plugins loaded into the server when plugins are enabled, or read misplaced logs including audit.log.
This page as .md · .json · CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.