CVE-2026-123516 · Package
NO FIX YET · SEE WHAT TO DO
Vikunja's file importer scans every entry in an uploaded ZIP archive, and crafted archives with many empty or non-file entries bypass the per-entry limits. An authenticated user can use this to consume excessive CPU and memory on the server.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that self-host Vikunja, the task management app, with user accounts that can upload ZIP files for import. Instances that do not allow untrusted users to import files are less exposed. The sources do not say whether hosted Vikunja services are affected.
Not affected if no-file-import, single-trusted-user
Who cares self-hosted, vikunja
2.7.1 are affected.2.7.1 or later.Vikunja before 2.7.1 contains a resource exhaustion vulnerability in the vikunja-file ZIP importer that allows authenticated users to consume CPU and memory by uploading archives with excessive entries. Attackers can upload export ZIPs containing many empty or non-files/ entries that bypass the per-entry caps, forcing scanArchive to process every entry twice.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.