CVE-2026-123516: Security vulnerability

Published Nov 8, 2026

Updated

Vikunja before 2.7.1 contains a resource exhaustion vulnerability in the vikunja-file ZIP importer that allows authenticated users to consume CPU and memory by uploading archives with excessive entries. Attackers can upload export ZIPs containing many empty or non-files/ entries that bypass the per-entry caps, forcing scanArchive to process every entry twice.

Event History

Nov 8, 2026

CVE Published

via NVD·02:16 AM

Data Sourced

via NVD·02:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated Vikunja user who can upload a vikunja-file export ZIP can trigger the resource exhaustion condition.

What archive characteristics are required for exploitation?

The ZIP must contain excessive entries, such as many empty entries or entries that are not files or directories. These entries bypass per-entry caps and cause scanArchive to process each entry twice.

Are instances running version 2.7.1 or later affected?

The issue is described as affecting Vikunja versions before 2.7.1.

CVE-2026-123516: Security vulnerability

Event History

Frequently Asked Questions

Who can exploit this issue?

What archive characteristics are required for exploitation?

Are instances running version 2.7.1 or later affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What archive characteristics are required for exploitation?

Are instances running version 2.7.1 or later affected?