{"id":"CVE-2026-123510","kind":"vulnerability","aliases":["CVE-2026-123510"],"related":[],"title":"Vikunja: plugin and log paths resolve to startup directory, enabling local plant","description":"Vikunja before 2.7.1 fails to re-anchor PluginsDir and LogPath to service.rootpath, allowing plugins to load from and logs to be written in the startup working directory. Local attackers able to write to that directory can plant plugins loaded into the server when plugins are enabled, or read misplaced logs including audit.log.","summary":"Vikunja before 2.7.1 does not anchor its plugin directory and log file path to the configured root path, so it uses the startup working directory instead. A local user who can write to that directory can plant a plugin that the server loads, or read misplaced logs including audit.log.","severity":"low","cvss":3.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux","package","self-hosted","vikunja"],"not_affected_if":["locked-working-directory","managed-hosting","plugins-disabled"],"how_to_check":"- Check the Vikunja version with the server binary's version flag or the release in use; affected builds are before `2.7.1`.\n- Look at whether plugins are enabled in the service configuration, since plugin loading is needed for the plant path.\n- Check the working directory the service starts in and who can write to it.","fix":"- Upgrade Vikunja to `2.7.1` or later.","status":"open","published_at":"2026-11-08T02:16:39+00:00","first_seen_at":"2026-11-08T02:21:08+00:00","triaged_at":"2026-11-08T02:26:44+00:00","updated_at":"2026-11-08T02:26:44+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-08T02:26:44Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Vikunja to `2.7.1` or later.","reach":"local","title":"Vikunja: plugin and log paths resolve to startup directory, enabling local plant","impact":"medium","summary":"Vikunja before 2.7.1 does not anchor its plugin directory and log file path to the configured root path, so it uses the startup working directory instead. A local user who can write to that directory can plant a plugin that the server loads, or read misplaced logs including audit.log.","audience":"businesses","category":"package","nicknames":[],"who_cares":["vikunja","self-hosted","linux"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"local user plants plugin code that the server loads","analyst_note":"","how_to_check":"- Check the Vikunja version with the server binary's version flag or the release in use; affected builds are before `2.7.1`.\n- Look at whether plugins are enabled in the service configuration, since plugin loading is needed for the plant path.\n- Check the working directory the service starts in and who can write to it.","plain_action":"","needs_analyst":false,"not_affected_if":["managed-hosting","plugins-disabled","locked-working-directory"],"who_is_affected":"Teams that self-host Vikunja before 2.7.1 and run it where a local user or process can write to the directory the service starts from. Plugin loading only matters if plugins are enabled. Instances started from a directory only administrators can write to are much less exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.0007,"input_tokens":4286,"output_tokens":542,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-123510':15A,18A '-2026':14A,17A '2.7.1':27B,76C 'abl':104C 'allow':87C 'anchor':30B,81C 'attack':103C 'audit.log':73B,126C 'configur':40B 'cve':13A,16A 'directori':9A,33B,49B,59B,101C,109C 'enabl':10A,120C 'fail':77C 'file':36B 'host':23B 'includ':72B,125C 'instead':50B 'linux':19B 'load':67B,90C,113C 'local':11A,52B,102C 'log':4A,35B,71B,93C,124C 'logpath':84C 'misplac':70B,123C 'packag':20B 'path':5A,37B,42B 'plant':12A,61B,111C 'plugin':2A,32B,63B,88C,112C,118C 'pluginsdir':82C 're':80C 're-anchor':79C 'read':69B,122C 'resolv':6A 'root':41B 'self':22B 'self-host':21B 'server':66B,116C 'service.rootpath':86C 'startup':8A,47B,99C 'use':45B 'user':53B 'vikunja':1A,24B,25B,74C 'work':48B,100C 'write':56B,106C 'written':96C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Vikunja before 2.7.1 and run it where a local user or process can write to the directory the service starts from. Plugin loading only matters if plugins are enabled. Instances started from a directory only administrators can write to are much less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["linux","low","package","selfhosted","vikunja"],"campaign_type":null,"search_a":"'-123510':15A,18A '-2026':14A,17A 'cve':13A,16A 'directori':9A 'enabl':10A 'local':11A 'log':4A 'path':5A 'plant':12A 'plugin':2A 'resolv':6A 'startup':8A 'vikunja':1A","search_b":"'2.7.1':27B 'anchor':30B 'audit.log':73B 'configur':40B 'directori':33B,49B,59B 'file':36B 'host':23B 'includ':72B 'instead':50B 'linux':19B 'load':67B 'local':52B 'log':35B,71B 'misplac':70B 'packag':20B 'path':37B,42B 'plant':61B 'plugin':32B,63B 'read':69B 'root':41B 'self':22B 'self-host':21B 'server':66B 'startup':47B 'use':45B 'user':53B 'vikunja':24B,25B 'work':48B 'write':56B","search_c":"'2.7.1':76C 'abl':104C 'allow':87C 'anchor':81C 'attack':103C 'audit.log':126C 'directori':101C,109C 'enabl':120C 'fail':77C 'includ':125C 'load':90C,113C 'local':102C 'log':93C,124C 'logpath':84C 'misplac':123C 'plant':111C 'plugin':88C,112C,118C 'pluginsdir':82C 're':80C 're-anchor':79C 'read':122C 'server':116C 'service.rootpath':86C 'startup':99C 'vikunja':74C 'work':100C 'write':106C 'written':96C","first_public_at":"2026-10-22T10:03:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123510","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123510","severity":null,"published_at":"2026-11-08T02:16:39+00:00","modified_at":"2026-11-08T02:16:39+00:00","first_seen_at":"2026-11-08T02:21:08+00:00","fetched_at":"2026-11-08T02:21:08+00:00","note":null}],"documents":[{"id":99169,"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-hrw2-p27j-8mj8","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T10:03:36+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99170,"url":"https://www.vulncheck.com/advisories/vikunja-before-2.7.1-plugin-and-log-directories-not-anchored-to-rootpath","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}