CVE-2026-27616
published 2026-02-25CVE-2026-27616: Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the application allows users to upload SVG files as task attachments…
PriorityP344high7.3CVSS 3.1
AVNACLPRLUIRSUCHIHAN
EPSS
0.45%
36.1th percentile
Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the application allows users to upload SVG files as task attachments. SVG is an XML-based format that supports JavaScript execution through elements such as tags or event handlers like onload. The application does not sanitize SVG content before storing it. When the uploaded SVG file is accessed via its direct URL, it is rendered inline in the browser under the application's origin. As a result, embedded JavaScript executes in the context of the authenticated user. Because the authentication token is stored in localStorage, it is accessible via JavaScript and can be retrieved by a malicious payload. Version 2.0.0 patches this issue.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| code.vikunja.io | api | 0 – 0.24.6 | — |
| go-vikunja | vikunja | < 2.0.0 | 2.0.0 |
| vikunja | vikunja | < 2.0.0 | 2.0.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure in code.vikunja.io/api
osv·2026-02-27
CVE-2026-27616 Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure in code.vikunja.io/api
Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure in code.vikunja.io/api
Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure in code.vikunja.io/api
GHSA
Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure
ghsa·2026-02-25
CVE-2026-27616 [HIGH] CWE-79 Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure
Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure
**Details**
The application allows users to upload SVG files as task attachments. SVG is an XML-based format that supports JavaScript execution through elements such as tags or event handlers like onload.
The application does not sanitize SVG content before storing it. When the uploaded SVG file is accessed via its direct URL, it is rendered inline in the browser under the application's origin. As a result, embedded JavaScript executes in the context of the authenticated user.
Because the authentication token is stored in localStorage, it is accessible via JavaScript and can be retrieved by a malicious payload.
Key security issues identified:
_No server-side sanitization of SVG content.
SVG attachments a
OSV
Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure
osv·2026-02-25
CVE-2026-27616 [HIGH] Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure
Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure
**Details**
The application allows users to upload SVG files as task attachments. SVG is an XML-based format that supports JavaScript execution through elements such as tags or event handlers like onload.
The application does not sanitize SVG content before storing it. When the uploaded SVG file is accessed via its direct URL, it is rendered inline in the browser under the application's origin. As a result, embedded JavaScript executes in the context of the authenticated user.
Because the authentication token is stored in localStorage, it is accessible via JavaScript and can be retrieved by a malicious payload.
Key security issues identified:
_No server-side sanitization of SVG content.
SVG attachments a
No detection rules found.
No public exploits indexed.
2026-02-25
Published