CVE-2026-35602

Katalog CVE

CVSS 7.1 · High EPSS 0,55%

Kerentanan Allocation of Resources Without Limits or Throttling pada vikunja. Skor CVSS 3.1 7.1 (High) menurut NVD.

Deskripsi (NVD)

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the Vikunja file import endpoint uses the attacker-controlled Size field from the JSON metadata inside the import zip instead of the actual decompressed file content length for the file size enforcement check. By setting Size to 0 in the JSON while including large compressed file entries in the zip, an attacker bypasses the configured maximum file size limit. This vulnerability is fixed in 2.3.0.

Rincian

Terbit di NVD

10 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,55% peluang dieksploitasi; lebih tinggi dari 44,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-qh78-rvg3-cv54 exploit · advisory vendor
• https://github.com/go-vikunja/vikunja/pull/2575 issue tracking
• https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0 release notes