GHSA-7gmh-4fw6-8xc5: Vikunja before 2.7.1 Orphaned Export Archives Enable Disk Exhaustion

Published Nov 8, 2026

Updated

Vikunja before 2.7.1 contains an improper resource cleanup vulnerability that leaves full-data export archives orphaned on disk after re-exports, failed exports, or account deletion. Authenticated users can repeatedly re-trigger exports containing all their attachments to exhaust disk storage, while deleted users' personal data remains retained indefinitely.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Vikunja to a version that resolves this vulnerability.
Fixed in 2.7.1

Event History

Nov 8, 2026

CVE Published

via OSV·01:37 AM

Data Sourced

via OSV·01:37 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated Vikunja user can repeatedly trigger full-data exports. The impact is greatest where users have attachments, because the orphaned export archives include all of their attachments.

What attacker access or actions are required?

The attacker needs an authenticated account and must trigger exports repeatedly. Orphaned archives can result from re-exports or failed exports, allowing disk usage to accumulate.

Are deleted accounts relevant to the impact?

Yes. When an account is deleted, that user's personal data may remain retained indefinitely because the associated export archives are not cleaned up.

Which deployments are affected?

Vikunja versions before 2.7.1 are affected. The provided information does not identify configuration-specific prerequisites or exclusions.

GHSA-7gmh-4fw6-8xc5: Vikunja before 2.7.1 Orphaned Export Archives Enable Disk Exhaustion

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What attacker access or actions are required?

Are deleted accounts relevant to the impact?

Which deployments are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What attacker access or actions are required?

Are deleted accounts relevant to the impact?

Which deployments are affected?