CVE-2026-35602

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the Vikunja file import endpoint uses the attacker-controlled Size field from the JSON metadata inside the import zip instead of the actual decompressed file content length for the file size enforcement check. By setting Size to 0 in the JSON while including large compressed file entries in the zip, an attacker bypasses the configured maximum file size limit. This vulnerability is fixed in 2.3.0.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Weakness enumeration

CWE-770

Affected software

No affected versions have been published.

Timeline

Published: Apr 10, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-356037.3Claude Code is an agentic coding tool. In versions prior to 2.1.75 on Windows, Claude Code loaded the system-wide default configuration from CVE-2026-356048.1File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Pri CVE-2026-356057.5File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Pri CVE-2026-356067.5File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Pri CVE-2026-356078.8File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Pri CVE-2026-356086.1QuickDrop is an easy-to-use file sharing application. Prior to 1.5.3, a stored XSS vulnerability exists in the file preview endpoint. The ap CVE-2026-35618.0Philips Hue Bridge hk_hap characteristics Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-CVE-2026-356108.8PolarLearn is a free and open-source learning program. In 0-PRERELEASE-14 and earlier, setCustomPassword(userId, password) and deleteUser(us CVE-2026-356117.5Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 to before 2.9.0, CVE-2026-356134.7coursevault-preview is a utility for previewing course material files from a configured directory. coursevault-preview versions prior to 0.1 CVE-2026-356149.8Frappe is a full-stack web application framework. Prior to 16.14.0 and 15.104.0, Frappe has a SQL injection in bulk_update. This vulnerabili CVE-2026-356157.5PraisonAI is a multi-agent teams system. Prior to 1.5.113, _validate_path() calls os.path.normpath() first, which collapses .. sequences, th