PT-2026-22033 · Vikunja · Vikunja

Architg1025 + 4 · Published 2026-02-25 · Updated 2026-03-25 · CVE-2026-27819

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vikunja versions prior to 2.0.0

Description The restoreConfig function in Vikunja fails to properly validate file paths within ZIP archives used for restoration. A specially crafted ZIP file can bypass directory restrictions, potentially overwriting arbitrary files on the system. Additionally, a malformed archive can cause a runtime panic, leading to a crash after the database has been wiped. The application directly uses the Name attribute of zip.File structs in file opening operations without validation, allowing for path traversal. The restoration process assumes a specific directory structure within the ZIP archive and does not adequately validate the length of slices derived from the archive contents, resulting in a panic when attempting to access an invalid index.

Recommendations Versions prior to 2.0.0 should be updated to version 2.0.0 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-248

CWE-22

Related Identifiers

CVE-2026-27819

GHSA-42WG-38GX-85RH

GO-2026-4556

SUSE-SU-2026:1042-1

Affected Products

Vikunja

References · 137

• 🔥 https://github.com/go-vikunja/vikunja/security/advisories/GHSA-42wg-38gx-85rh · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27819.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-27819 · Security Note
• https://osv.dev/vulnerability/GHSA-42wg-38gx-85rh · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1042-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4556 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27819 · Vendor Advisory
• https://github.com/go-vikunja/vikunja · Note
• https://github.com/go-vikunja/vikunja/commit/1b3d8dc59cb5f2b759ab0ad2bc9915b993e3cb73 · Note
• https://suse.com/security/cve/CVE-2026-27575 · Note
• https://suse.com/security/cve/CVE-2026-28407 · Note
• https://suse.com/security/cve/CVE-2026-27965 · Note
• https://suse.com/security/cve/CVE-2026-32136 · Note
• https://suse.com/security/cve/CVE-2026-27616 · Note
• https://suse.com/security/cve/CVE-2026-30943 · Note