{"id":"CVE-2026-123516","kind":"vulnerability","aliases":["CVE-2026-123516"],"related":[],"title":"Vikunja: crafted ZIP imports exhaust CPU and memory","description":"Vikunja before 2.7.1 contains a resource exhaustion vulnerability in the vikunja-file ZIP importer that allows authenticated users to consume CPU and memory by uploading archives with excessive entries. Attackers can upload export ZIPs containing many empty or non-files/ entries that bypass the per-entry caps, forcing scanArchive to process every entry twice.","summary":"Vikunja's file importer scans every entry in an uploaded ZIP archive, and crafted archives with many empty or non-file entries bypass the per-entry limits. An authenticated user can use this to consume excessive CPU and memory on the server.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","vikunja"],"not_affected_if":["no-file-import","single-trusted-user"],"how_to_check":"- Check the installed Vikunja version; versions before `2.7.1` are affected.\n- Review whether untrusted users have accounts that can upload files or export archives to the instance.","fix":"- Vikunja: move to `2.7.1` or later.","status":"open","published_at":"2026-11-08T02:16:40+00:00","first_seen_at":"2026-11-08T02:21:09+00:00","triaged_at":"2026-11-08T02:23:33+00:00","updated_at":"2026-11-08T02:23:33+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T02:23:33Z","model":"claude-haiku-5-5","output":{"fix":"- Vikunja: move to `2.7.1` or later.","reach":"network","title":"Vikunja: crafted ZIP imports exhaust CPU and memory","impact":"medium","summary":"Vikunja's file importer scans every entry in an uploaded ZIP archive, and crafted archives with many empty or non-file entries bypass the per-entry limits. An authenticated user can use this to consume excessive CPU and memory on the server.","audience":"businesses","category":"package","nicknames":[],"who_cares":["vikunja","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated users can exhaust server CPU and memory, causing denial of service.","analyst_note":"","how_to_check":"- Check the installed Vikunja version; versions before `2.7.1` are affected.\n- Review whether untrusted users have accounts that can upload files or export archives to the instance.","plain_action":"","needs_analyst":false,"not_affected_if":["no-file-import","single-trusted-user"],"who_is_affected":"Teams that self-host Vikunja, the task management app, with user accounts that can upload ZIP files for import. Instances that do not allow untrusted users to import files are less exposed. The sources do not say whether hosted Vikunja services are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000674,"input_tokens":4298,"output_tokens":489,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123516':11A,14A '-2026':10A,13A '2.7.1':66C 'allow':80C 'archiv':31B,34B,90C 'attack':94C 'authent':50B,81C 'bypass':43B,108C 'cap':113C 'consum':56B,84C 'contain':67C,99C 'cpu':6A,58B,85C 'craft':2A,33B 'cve':9A,12A 'empti':37B,101C 'entri':26B,42B,47B,93C,106C,112C,119C 'everi':25B,118C 'excess':57B,92C 'exhaust':5A,70C 'export':97C 'file':22B,41B,76C,105C 'forc':114C 'host':18B 'import':4A,23B,78C 'limit':48B 'mani':36B,100C 'memori':8A,60B,87C 'non':40B,104C 'non-fil':39B,103C 'packag':15B 'per':46B,111C 'per-entri':45B,110C 'process':117C 'resourc':69C 'scan':24B 'scanarch':115C 'self':17B 'self-host':16B 'server':63B 'twice':120C 'upload':29B,89C,96C 'use':53B 'user':51B,82C 'vikunja':1A,19B,20B,64C,75C 'vikunja-fil':74C 'vulner':71C 'zip':3A,30B,77C,98C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Vikunja, the task management app, with user accounts that can upload ZIP files for import. Instances that do not allow untrusted users to import files are less exposed. The sources do not say whether hosted Vikunja services are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","selfhosted","vikunja"],"campaign_type":null,"search_a":"'-123516':11A,14A '-2026':10A,13A 'cpu':6A 'craft':2A 'cve':9A,12A 'exhaust':5A 'import':4A 'memori':8A 'vikunja':1A 'zip':3A","search_b":"'archiv':31B,34B 'authent':50B 'bypass':43B 'consum':56B 'cpu':58B 'craft':33B 'empti':37B 'entri':26B,42B,47B 'everi':25B 'excess':57B 'file':22B,41B 'host':18B 'import':23B 'limit':48B 'mani':36B 'memori':60B 'non':40B 'non-fil':39B 'packag':15B 'per':46B 'per-entri':45B 'scan':24B 'self':17B 'self-host':16B 'server':63B 'upload':29B 'use':53B 'user':51B 'vikunja':19B,20B 'zip':30B","search_c":"'2.7.1':66C 'allow':80C 'archiv':90C 'attack':94C 'authent':81C 'bypass':108C 'cap':113C 'consum':84C 'contain':67C,99C 'cpu':85C 'empti':101C 'entri':93C,106C,112C,119C 'everi':118C 'excess':92C 'exhaust':70C 'export':97C 'file':76C,105C 'forc':114C 'import':78C 'mani':100C 'memori':87C 'non':104C 'non-fil':103C 'per':111C 'per-entri':110C 'process':117C 'resourc':69C 'scanarch':115C 'twice':120C 'upload':89C,96C 'user':82C 'vikunja':64C,75C 'vikunja-fil':74C 'vulner':71C 'zip':77C,98C","first_public_at":"2026-10-22T10:05:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123516","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123516","severity":null,"published_at":"2026-11-08T02:16:40+00:00","modified_at":"2026-11-08T02:16:40+00:00","first_seen_at":"2026-11-08T02:21:09+00:00","fetched_at":"2026-11-08T02:21:09+00:00","note":null}],"documents":[{"id":99181,"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-mqq8-869v-48q8","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T10:05:12+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99182,"url":"https://www.vulncheck.com/advisories/vikunja-before-2.7.1-resource-exhaustion-via-vikunja-file-zip-import","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}