CVE-2026-35601

MediumCVSS 4.1/10Last modified Jun 17, 2026

Description

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CalDAV output generator builds iCalendar VTODO entries via raw string concatenation without applying RFC 5545 TEXT value escaping. User-controlled task titles containing CRLF characters break the iCalendar property boundary, allowing injection of arbitrary iCalendar properties such as ATTACH, VALARM, or ORGANIZER. This vulnerability is fixed in 2.3.0.

Metrics

CVSS 3.1 4.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N

Weakness enumeration

CWE-93

Affected software

No affected versions have been published.

Timeline

Published
Apr 10, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-356027.1Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the Vikunja file import endpoint uses the attacker-controlleCVE-2026-356037.3Claude Code is an agentic coding tool. In versions prior to 2.1.75 on Windows, Claude Code loaded the system-wide default configuration fromCVE-2026-356048.1File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. PriCVE-2026-356057.5File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. PriCVE-2026-356067.5File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. PriCVE-2026-356078.8File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. PriCVE-2026-356086.1QuickDrop is an easy-to-use file sharing application. Prior to 1.5.3, a stored XSS vulnerability exists in the file preview endpoint. The apCVE-2026-35618.0Philips Hue Bridge hk_hap characteristics Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-CVE-2026-356108.8PolarLearn is a free and open-source learning program. In 0-PRERELEASE-14 and earlier, setCustomPassword(userId, password) and deleteUser(usCVE-2026-356117.5Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 to before 2.9.0, CVE-2026-356134.7coursevault-preview is a utility for previewing course material files from a configured directory. coursevault-preview versions prior to 0.1CVE-2026-356149.8Frappe is a full-stack web application framework. Prior to 16.14.0 and 15.104.0, Frappe has a SQL injection in bulk_update. This vulnerabili