CVE-2026-35601: Vikunja has an iCalendar Property Injection via CRLF in CalDAV Task Output

Vulnerability summary

CVE-2026-35601 is a medium (CVSS 4.1) CRLF Injection vulnerability in go-vikunja vikunja. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 24% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 10-04-2026
   PublishedVulnerability first disclosed.
2. 13-04-2026
   Last modifiedVulnerability information updated.

Description

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CalDAV output generator builds iCalendar VTODO entries via raw string concatenation without applying RFC 5545 TEXT value escaping. User-controlled task titles containing CRLF characters break the iCalendar property boundary, allowing injection of arbitrary iCalendar properties such as ATTACH, VALARM, or ORGANIZER. This vulnerability is fixed in 2.3.0.

• CWE-93Improper Neutralization of CRLF Sequences ('CRLF Injection')The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.