CVE-2026-27819

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27819", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-24T02:32:39.799Z", "datePublished": "2026-02-25T21:40:38.703Z", "dateUpdated": "2026-02-26T20:24:45.237Z"}, "containers": {"cna": {"title": "Vikunja has Path Traversal in CLI Restore", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-248", "lang": "en", "description": "CWE-248: Uncaught Exception", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-42wg-38gx-85rh", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-42wg-38gx-85rh"}, {"name": "https://vikunja.io/changelog/vikunja-v2.0.0-was-released", "tags": ["x_refsource_MISC"], "url": "https://vikunja.io/changelog/vikunja-v2.0.0-was-released"}], "affected": [{"vendor": "go-vikunja", "product": "vikunja", "versions": [{"version": "< 2.0.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-25T21:40:38.703Z"}, "descriptions": [{"lang": "en", "value": "Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the restoreConfig function in vikunja/pkg/modules/dump/restore.go of the go-vikunja/vikunja repository fails to sanitize file paths within the provided ZIP archive. A maliciously crafted ZIP can bypass the intended extraction directory to overwrite arbitrary files on the host system. Additionally, we\u2019ve discovered that a malformed archive triggers a runtime panic, crashing the process immediately after the database has been wiped permanently. The application trusts the metadata in the ZIP archive. It uses the Name attribute of the zip.File struct directly in os.OpenFile calls without validation, allowing files to be written outside the intended directory. The restoration logic assumes a specific directory structure within the ZIP. When provided with a \"minimalist\" malicious ZIP, the application fails to validate the length of slices derived from the archive contents. Specifically, at line 154, the code attempts to access an index of len(ms)-2 on an insufficiently populated slice, triggering a panic. Version 2.0.0 fixes the issue."}], "source": {"advisory": "GHSA-42wg-38gx-85rh", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-26T20:24:27.445438Z", "id": "CVE-2026-27819", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T20:24:45.237Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Vikunja has Path Traversal in CLI Restore", "source": {"advisory": "GHSA-42wg-38gx-85rh", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "go-vikunja", "product": "vikunja", "versions": [{"status": "affected", "version": "< 2.0.0"}]}], "references": [{"url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-42wg-38gx-85rh", "name": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-42wg-38gx-85rh", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://vikunja.io/changelog/vikunja-v2.0.0-was-released", "name": "https://vikunja.io/changelog/vikunja-v2.0.0-was-released", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the restoreConfig function in vikunja/pkg/modules/dump/restore.go of the go-vikunja/vikunja repository fails to sanitize file paths within the provided ZIP archive. A maliciously crafted ZIP can bypass the intended extraction directory to overwrite arbitrary files on the host system. Additionally, we\u2019ve discovered that a malformed archive triggers a runtime panic, crashing the process immediately after the database has been wiped permanently. The application trusts the metadata in the ZIP archive. It uses the Name attribute of the zip.File struct directly in os.OpenFile calls without validation, allowing files to be written outside the intended directory. The restoration logic assumes a specific directory structure within the ZIP. When provided with a \"minimalist\" malicious ZIP, the application fails to validate the length of slices derived from the archive contents. Specifically, at line 154, the code attempts to access an index of len(ms)-2 on an insufficiently populated slice, triggering a panic. Version 2.0.0 fixes the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-248", "description": "CWE-248: Uncaught Exception"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-25T21:40:38.703Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27819", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-26T20:24:27.445438Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-02-26T20:24:34.581Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-27819", "state": "PUBLISHED", "dateUpdated": "2026-02-25T21:40:38.703Z", "dateReserved": "2026-02-24T02:32:39.799Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-25T21:40:38.703Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "vikunja", "vendor": "go-vikunja", "versions": [{"status": "affected", "version": "< 2.0.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vikunja:vikunja:*:*:*:*:*:*:*:*", "matchCriteriaId": "53D82FAD-8E42-40F8-A11D-1FE7EDB4620B", "versionEndExcluding": "2.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the restoreConfig function in vikunja/pkg/modules/dump/restore.go of the go-vikunja/vikunja repository fails to sanitize file paths within the provided ZIP archive. A maliciously crafted ZIP can bypass the intended extraction directory to overwrite arbitrary files on the host system. Additionally, we\u2019ve discovered that a malformed archive triggers a runtime panic, crashing the process immediately after the database has been wiped permanently. The application trusts the metadata in the ZIP archive. It uses the Name attribute of the zip.File struct directly in os.OpenFile calls without validation, allowing files to be written outside the intended directory. The restoration logic assumes a specific directory structure within the ZIP. When provided with a \"minimalist\" malicious ZIP, the application fails to validate the length of slices derived from the archive contents. Specifically, at line 154, the code attempts to access an index of len(ms)-2 on an insufficiently populated slice, triggering a panic. Version 2.0.0 fixes the issue."}, {"lang": "es", "value": "Vikunja es una plataforma de gesti\u00f3n de tareas de c\u00f3digo abierto y autoalojada. Antes de la versi\u00f3n 2.0.0, la funci\u00f3n restoreConfig en vikunja/pkg/modules/dump/restore.go del repositorio go-vikunja/vikunja no logra sanear las rutas de archivo dentro del archivo ZIP proporcionado. Un ZIP creado maliciosamente puede eludir el directorio de extracci\u00f3n previsto para sobrescribir archivos arbitrarios en el sistema anfitri\u00f3n. Adem\u00e1s, hemos descubierto que un archivo malformado desencadena un p\u00e1nico en tiempo de ejecuci\u00f3n, bloqueando el proceso inmediatamente despu\u00e9s de que la base de datos haya sido borrada permanentemente. La aplicaci\u00f3n conf\u00eda en los metadatos del archivo ZIP. Utiliza el atributo Name de la estructura zip.File directamente en las llamadas a os.OpenFile sin validaci\u00f3n, permitiendo que los archivos se escriban fuera del directorio previsto. La l\u00f3gica de restauraci\u00f3n asume una estructura de directorio espec\u00edfica dentro del ZIP. Cuando se le proporciona un ZIP malicioso 'minimalista', la aplicaci\u00f3n no logra validar la longitud de las 'slices' derivadas del contenido del archivo. Espec\u00edficamente, en la l\u00ednea 154, el c\u00f3digo intenta acceder a un \u00edndice de len(ms)-2 en una 'slice' insuficientemente poblada, desencadenando un p\u00e1nico. La versi\u00f3n 2.0.0 corrige el problema."}], "id": "CVE-2026-27819", "lastModified": "2026-06-17T10:27:44.290", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27819", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-26T20:24:27.445438Z", "version": "2.0.3"}}]}, "published": "2026-02-25T22:16:27.127", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-42wg-38gx-85rh"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://vikunja.io/changelog/vikunja-v2.0.0-was-released"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-248"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.0.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "vikunja", "source": "cna", "vendor": "go-vikunja"}, "product": "vikunja", "vendor": "go-vikunja"}], "analysis": {"en": {"generated_at": "2026-04-17T14:47:29.822057+00:00", "value": {"mitigation_remediation": ["Apply the latest Vikunja release (2.0.0 or newer) where the restore function sanitizes file paths and validates archive structure.", "Restrict execution of the restore CLI to trusted users or environments; ensure the command is not exposed to untrusted input sources.", "Validate or sanitize ZIP archive contents before invoking restore; disallow paths containing '..' or absolute components and check slice lengths to prevent runtime panics.", "Consider disabling or removing the restore functionality if it is not required for your deployment."], "summary": {"action": "Immediate Patch", "impact": "Arbitrary File Overwrite"}, "threat_synthesis": {"affected_systems": "All installations of the Vikunja task-management platform built from the go-vikunja/vikunja repository that use a version older than 2.0.0. The affected component is the CLI restore command in the modules/dump/restore.go module. Self-hosted deployments running any pre-2.0.0 release are vulnerable when processing a malicious ZIP archive during restoration.", "description_and_impact": "A malformed ZIP archive processed by Vikunja's CLI restore command fails to sanitize file paths, allowing files to be written outside the intended extraction directory and thereby enabling arbitrary file overwrite on the host system; the vulnerability can also trigger a runtime panic that crashes the process and wipes the database immediately after restoration, resulting in denial of service. This weakness manifests as a Path Traversal flaw (CWE-22) and a Crash via unchecked slice bounds (CWE-248).", "risk_and_exploitability": "The vulnerability has a CVSS v3.1 base score of 7.2, indicating a high impact severity. The EPSS score is below 1%, implying a very low current exploitation probability, and the issue is not listed in the CISA KEV catalog. The likely attack vector requires an attacker able to run the restore command locally or to supply a crafted ZIP archive to a system that accepts restoration; the manipulation of the zip file enables overwriting of arbitrary files, which could lead to privilege escalation or code injection, and the induced crash can cause service disruption and data loss. Proper privilege isolation of the restore process and sanitization of archive paths mitigate these risks."}}}}, "created": "2026-02-26T13:10:50.506647+00:00", "updated": "2026-04-17T15:00:11.012883+00:00", "vendors": ["go-vikunja", "go-vikunja$PRODUCT$vikunja"]}