{"id":"EUVD-2026-21429","enisaUuid":"6cfd5b18-01cf-3dbc-8861-09a691d0594f","description":"Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the Vikunja file import endpoint uses the attacker-controlled Size field from the JSON metadata inside the import zip instead of the actual decompressed file content length for the file size enforcement check. By setting Size to 0 in the JSON while including large compressed file entries in the zip, an attacker bypasses the configured maximum file size limit. This vulnerability is fixed in 2.3.0.","datePublished":"Apr 10, 2026, 4:10:39 PM","dateUpdated":"Apr 14, 2026, 2:19:30 PM","baseScore":5.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-qh78-rvg3-cv54\nhttps://github.com/go-vikunja/vikunja/pull/2575\nhttps://github.com/go-vikunja/vikunja/releases/tag/v2.3.0\n","aliases":"CVE-2026-35602\nGHSA-qh78-rvg3-cv54\n","assigner":"GitHub_M","epss":0.34,"enisaIdProduct":[{"id":"548130a8-6529-3ed1-b7d6-e313675f0830","product":{"name":"vikunja","vendor":{"name":"go-vikunja"}},"product_version":"\u003c 2.3.0"}],"enisaIdVendor":[{"id":"21d650ca-12a5-32ce-bb06-ec2c1ea39b11","vendor":{"name":"go-vikunja"}}],"enisaIdVulnerability":[{"id":"4e75d21d-bfd2-3bd5-a9fa-31712b3f84d2","vulnerability":{"id":"GHSA-qh78-rvg3-cv54","description":"Vikunja has File Size Limit Bypass via Vikunja Import","datePublished":"Apr 10, 2026, 3:35:18 PM","dateUpdated":"Apr 10, 2026, 7:46:01 PM","baseScore":0.0,"references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-qh78-rvg3-cv54\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-35602\nhttps://github.com/go-vikunja/vikunja/pull/2575\nhttps://github.com/go-vikunja/vikunja\nhttps://github.com/go-vikunja/vikunja/releases/tag/v2.3.0\n","enisa_id":"EUVD-2026-21429\n","aliases":"CVE-2026-35602\nGHSA-qh78-rvg3-cv54\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"ddeccd6a-4964-3560-90e3-21c623da7bb6","vulnerability":{"id":"CVE-2026-35602","description":"Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the Vikunja file import endpoint uses the attacker-controlled Size field from the JSON metadata inside the import zip instead of the actual decompressed file content length for the file size enforcement check. By setting Size to 0 in the JSON while including large compressed file entries in the zip, an attacker bypasses the configured maximum file size limit. This vulnerability is fixed in 2.3.0.","datePublished":"Apr 10, 2026, 4:10:39 PM","dateUpdated":"Apr 14, 2026, 2:19:30 PM","status":"PUBLISHED","baseScore":5.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","references":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-qh78-rvg3-cv54\nhttps://github.com/go-vikunja/vikunja/pull/2575\nhttps://github.com/go-vikunja/vikunja/releases/tag/v2.3.0\n","enisa_id":"EUVD-2026-21429\n","assigner":"GitHub_M","epss":0.34,"dataProcessed":"Oct 27, 2026, 7:18:59 AM","vulnerabilityProduct":[{"id":"bea83ef8-78ef-3400-9074-3f2efb2f9706","product":{"name":"vikunja","vendor":{"name":"go-vikunja"}},"product_version":"\u003c 2.3.0"}],"vulnerabilityVendor":[{"id":"82942003-a5b0-3223-ad05-54734e60a65d","vendor":{"name":"go-vikunja"}}]}}],"enisaIdAdvisory":[]}