GHSA-mqq8-869v-48q8: Vikunja before 2.7.1 Resource Exhaustion via Vikunja-File ZIP Import

Published Nov 8, 2026

Updated

Vikunja before 2.7.1 contains a resource exhaustion vulnerability in the vikunja-file ZIP importer that allows authenticated users to consume CPU and memory by uploading archives with excessive entries. Attackers can upload export ZIPs containing many empty or non-files/ entries that bypass the per-entry caps, forcing scanArchive to process every entry twice.

Event History

Nov 8, 2026

CVE Published

via OSV·01:37 AM

Data Sourced

via OSV·01:37 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated Vikunja user who can upload a Vikunja export ZIP can trigger the resource exhaustion condition. The issue is relevant to deployments that allow users to import these archives.

What does an attacker need to include in an upload?

The attacker needs a Vikunja-file ZIP archive with excessive entries, such as many empty entries or entries that are not files. These entries bypass per-entry caps and cause scanArchive to process every entry twice, consuming CPU and memory.

Which versions are affected?

Vikunja versions before 2.7.1 are affected. Updating to 2.7.1 or later addresses the stated affected version range.

GHSA-mqq8-869v-48q8: Vikunja before 2.7.1 Resource Exhaustion via Vikunja-File ZIP Import

Event History

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to include in an upload?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to include in an upload?

Which versions are affected?