PT-2026-31952 · Vikunja · Vikunja

Published 2026-04-10 · Updated 2026-05-20 · CVE-2026-35601

Positive Technologies (AI Summary)

CVSS v3.1

4.1

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Vikunja versions prior to 2.3.0

Description Vikunja, a self-hosted task management platform, has an issue where the CalDAV output generator doesn't properly escape characters in iCalendar VTODO entries. Specifically, user-controlled task titles containing CRLF (carriage return and line feed) characters can break the iCalendar property boundary. This allows for the injection of arbitrary iCalendar properties like ATTACH, VALARM, or ORGANIZER. The ParseTodos function at pkg/caldav/caldav.go:146 concatenates the task summary directly into the iCalendar output without applying necessary escaping. This can lead to the injection of malicious attachment URLs, fake alarm notifications, or spoofing of organizer identity. The vulnerability is present in versions before 2.3.0.

Recommendations Update to version 2.3.0 or later.

Exploit

Fix

Weakness Enumeration

CWE-93

Related Identifiers

CVE-2026-35601

GHSA-2G7H-7RQR-9P4R

GO-2026-4951

Affected Products

Vikunja

References · 8

• 🔥 https://github.com/go-vikunja/vikunja/security/advisories/GHSA-2g7h-7rqr-9p4r · Exploit
• https://osv.dev/vulnerability/GHSA-2g7h-7rqr-9p4r · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4951 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35601 · Security Note
• https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0 · Note
• https://github.com/go-vikunja/vikunja/pull/2580 · Note
• https://github.com/go-vikunja/vikunja · Note
• https://twitter.com/CVEnew/status/2042710235853246926 · Twitter Post