CVE-2026-33675

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the migration helper functions `DownloadFile` and `DownloadFileWithHeaders` in `pkg/modules/migration/helpers.go` make arbitrary HTTP GET requests without any SSRF protection. When a user triggers a Todoist or Trello migration, file attachment URLs from the third-party API response are passed directly to these functions, allowing an attacker to force the Vikunja server to fetch internal network resources and return the response as a downloadable task attachment. Version 2.2.1 patches the issue.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
go-vikunja	vikunja	< 2.2.1

References

https://github.com/go-vikunja/vikunja/commit/93297742236e3d33af72c993e5da960db01d259ePatch
https://github.com/go-vikunja/vikunja/security/advisories/GHSA-g66v-54v9-52prExploit, Vendor Advisory
https://vikunja.io/changelog/vikunja-v2.2.2-was-releasedRelease Notes
https://github.com/go-vikunja/vikunja/security/advisories/GHSA-g66v-54v9-52prExploit, Vendor Advisory

Timeline

Published: Mar 24, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-336766.5Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, when the Vikunja API returns tasks, it populates the CVE-2026-336776.5Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the `GET /api/v1/projects/:project/webhooks` endpoin CVE-2026-336788.1Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, `TaskAttachment.ReadOne()` queries attachments by ID CVE-2026-336797.4Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the `DownloadImage` function in `pkg/utils/avatar.go CVE-2026-33687.2The Injection Guard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via malicious query parameter names in all versions up CVE-2026-336806.5Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.2, the `LinkSharing.ReadAll()` method allows link share CVE-2026-336817.2WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/pluginRunDatabaseScript.json.php` endpoint CVE-2026-336824.8Streamlit is a data oriented application development framework for python. Streamlit Open Source versions prior to 1.54.0 running on Windows CVE-2026-336835.4WWBN AVideo is an open source video platform. In versions up to and including 26.0, a sanitization order-of-operations flaw in the user prof CVE-2026-336845.3WWBN AVideo is an open source video platform. Prior to version 29.0, Privilege Escalation is possible through unguarded permission parameter CVE-2026-336855.3WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `plugin/AD_Server/reports.json.php` endpoint perform CVE-2026-336868.8Sharp is a content management framework built for Laravel as a package. Versions prior to 9.20.0 have a path traversal vulnerability in the