GHSA-hrw2-p27j-8mj8: Vikunja before 2.7.1 Plugin and Log Directories Not Anchored to Rootpath

Published Nov 8, 2026

Updated

Vikunja before 2.7.1 fails to re-anchor PluginsDir and LogPath to service.rootpath, allowing plugins to load from and logs to be written in the startup working directory. Local attackers able to write to that directory can plant plugins loaded into the server when plugins are enabled, or read misplaced logs including audit.log.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Vikunja to a version that resolves this vulnerability.
Fixed in 2.7.1

Event History

Nov 8, 2026

CVE Published

via OSV·01:37 AM

Data Sourced

via OSV·01:37 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Deployments running Vikunja before 2.7.1 are exposed if a local attacker can write to the server's startup working directory. Plugin-related impact also requires plugins to be enabled.

What does an attacker need to exploit the plugin-loading impact?

The attacker needs local write access to the startup working directory and plugins must be enabled. They can plant a plugin there that is loaded by the server.

Can logs be exposed even if plugins are disabled?

Yes. Logs may be written to the startup working directory rather than under service.rootpath, allowing a local attacker who can read that location to access misplaced logs, including audit.log.

GHSA-hrw2-p27j-8mj8: Vikunja before 2.7.1 Plugin and Log Directories Not Anchored to Rootpath

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit the plugin-loading impact?

Can logs be exposed even if plugins are disabled?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit the plugin-loading impact?

Can logs be exposed even if plugins are disabled?