GHSA-rp64-xg8g-9mpr: Vikunja before 2.7.1 Insecure Permissions on Dump Archive via vikunja dump

Published Nov 8, 2026

Updated

Vikunja before 2.7.1 contains an insecure file permissions vulnerability that allows local users to read dump archives created with umask permissions by the vikunja dump command. Local attackers on a shared host can read the world-readable zip in the rootpath to obtain config, password hashes, TOTP secrets, tokens, and stored files.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Vikunja to a version that resolves this vulnerability.
Fixed in 2.7.1

Event History

Nov 8, 2026

CVE Published

via OSV·01:37 AM

Data Sourced

via OSV·01:37 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Vikunja deployments before 2.7.1 are exposed when dump archives are created on a shared host where other local users can access the Vikunja rootpath. Those users may be able to read a world-readable dump archive.

What does an attacker need to exploit it?

An attacker needs local access to the shared host and access to the location where the vikunja dump command writes its archive. No remote access path is described.

What information could be disclosed from an affected dump archive?

The archive may expose configuration data, password hashes, TOTP secrets, tokens, and stored files.

How can I determine whether I may already be affected?

Check whether a Vikunja version before 2.7.1 has run vikunja dump and whether the resulting ZIP archive in the rootpath is readable by other local users. Any such archive should be treated as potentially exposing its contents.

GHSA-rp64-xg8g-9mpr: Vikunja before 2.7.1 Insecure Permissions on Dump Archive via vikunja dump

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What information could be disclosed from an affected dump archive?

How can I determine whether I may already be affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What information could be disclosed from an affected dump archive?

How can I determine whether I may already be affected?