{"id":"CVE-2026-35602","sourceIdentifier":"security-advisories@github.com","published":"2026-04-10T17:17:03.993","lastModified":"2026-10-26T21:10:00.170","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the Vikunja file import endpoint uses the attacker-controlled Size field from the JSON metadata inside the import zip instead of the actual decompressed file content length for the file size enforcement check. By setting Size to 0 in the JSON while including large compressed file entries in the zip, an attacker bypasses the configured maximum file size limit. This vulnerability is fixed in 2.3.0."},{"lang":"es","value":"Vikunja es una plataforma de gestión de tareas de código abierto y autoalojada. Antes de 2.3.0, el endpoint de importación de archivos de Vikunja utiliza el campo ’Size’ controlado por el atacante de los metadatos JSON dentro del archivo zip de importación en lugar de la longitud real del contenido del archivo descomprimido para la comprobación de cumplimiento del tamaño del archivo. Al establecer ’Size’ en 0 en el JSON mientras se incluyen entradas de archivos comprimidos grandes en el zip, un atacante omite el límite máximo de tamaño de archivo configurado. Esta vulnerabilidad se corrigió en 2.3.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"go-vikunja","product":"vikunja","versions":[{"version":"< 2.3.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-04-14T14:19:25.945976Z","id":"CVE-2026-35602","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:*","versionEndExcluding":"2.3.0","matchCriteriaId":"CC8B46CF-6E7B-46F4-8275-D1A38F2A6D5E"}]}]}],"references":[{"url":"https://github.com/go-vikunja/vikunja/pull/2575","source":"security-advisories@github.com","tags":["Issue Tracking"]},{"url":"https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-qh78-rvg3-cv54","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-qh78-rvg3-cv54","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"]}]}