---
id: "CVE-2026-123510"
page: "https://infrastack.ai/live/CVE-2026-123510"
kind: "vulnerability"
aliases: ["CVE-2026-123510"]
title: "Vikunja: plugin and log paths resolve to startup directory, enabling local plant"
severity: "low"
cvss: 3.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["linux", "package", "self-hosted", "vikunja"]
not_affected_if: ["locked-working-directory", "managed-hosting", "plugins-disabled"]
published_at: "2026-11-08T02:16:39+00:00"
first_seen_at: "2026-11-08T02:21:08+00:00"
updated_at: "2026-11-08T02:26:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123510", "first_seen_at": "2026-11-08T02:21:08+00:00"}]
exploit_sources: []
---

# Vikunja: plugin and log paths resolve to startup directory, enabling local plant

Link for people: https://infrastack.ai/live/CVE-2026-123510 (this .md is for agents)

Vikunja before 2.7.1 does not anchor its plugin directory and log file path to the configured root path, so it uses the startup working directory instead. A local user who can write to that directory can plant a plugin that the server loads, or read misplaced logs including audit.log.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Vikunja version with the server binary's version flag or the release in use; affected builds are before `2.7.1`.
- Look at whether plugins are enabled in the service configuration, since plugin loading is needed for the plant path.
- Check the working directory the service starts in and who can write to it.

## Fix

- Upgrade Vikunja to `2.7.1` or later.

## Timeline

- 2026-11-08T02:21:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123510

## Documents

- [advisory] Vendor advisory: github.com https://github.com/go-vikunja/vikunja/security/advisories/GHSA-hrw2-p27j-8mj8
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/vikunja-before-2.7.1-plugin-and-log-directories-not-anchored-to-rootpath

## From the sources

Vikunja before 2.7.1 fails to re-anchor PluginsDir and LogPath to service.rootpath, allowing plugins to load from and logs to be written in the startup working directory. Local attackers able to write to that directory can plant plugins loaded into the server when plugins are enabled, or read misplaced logs including audit.log.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_