CVE-2026-27819 Vikunja has Path Traversal in CLI Restore
Attackers can overwrite arbitrary files and crash the application via a malicious ZIP archive during CLI restore operations in Vikunja.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-27819?
CVE-2026-27819 is a high-severity path traversal vulnerability in go-vikunja vikunja, published on 25 Feb 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the restoreConfig function in vikunja/pkg/modules/dump/restore.go of the go-vikunja/vikunja repository fails to sanitize file paths within the provided ZIP archive. A maliciously crafted ZIP can bypass the intended extraction directory to overwrite arbitrary files on the host system. Additionally, we’ve discovered that a malformed archive triggers a runtime panic, crashing the process immediately after the database has been wiped permanently. The application trusts the metadata in the ZIP archive. It uses the Name attribute of the zip.File struct directly in os.OpenFile calls without validation, allowing files to be written outside the intended directory. The restoration logic assumes a specific directory structure within the ZIP. When provided with a "minimalist" malicious ZIP, the application fails to validate the length of slices derived from the archive contents. Specifically, at line 154, the code attempts to access an index of len(ms)-2 on an insufficiently populated slice, triggering a panic. Version 2.0.0 fixes the issue.
Which versions are affected by CVE-2026-27819?
3 open source packages ship an affected version, including code.vikunja.io/api. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
code.vikunja.io/api Go | All versions | None |
code.vikunja.io/api Go | All versions to 0.24.6 | None |
code.vikunja.io/api Go | All versions to 0.24.6 | None |
Products include Vikunja Vikunja.
How do I fix CVE-2026-27819?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-27819 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27819 exists.
Other vulnerabilities in go-vikunja vikunja
- CVE-2026-28268 Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse
- CVE-2026-27575 Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change
- CVE-2026-25935 Vikunja Affected by XSS Via Task Preview
- CVE-2026-35595 Vikunja Affected by Privilege Escalation via Project Reparenting
- CVE-2026-33316 Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement
Sources
Also known as GHSA-42wg-38gx-85rh, GO-2026-4556.