CVE-2026-35602: Vikunja has a File Size Limit Bypass via Vikunja Import

Vulnerability summary

CVE-2026-35602 is a high (CVSS 7.1) vulnerability in go-vikunja vikunja. EPSS estimates a 0.55% chance of exploitation in the next 30 days, higher than 45.4% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 10-04-2026
   PublishedVulnerability first disclosed.
2. 14-04-2026
   Last modifiedVulnerability information updated.

Description

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the Vikunja file import endpoint uses the attacker-controlled Size field from the JSON metadata inside the import zip instead of the actual decompressed file content length for the file size enforcement check. By setting Size to 0 in the JSON while including large compressed file entries in the zip, an attacker bypasses the configured maximum file size limit. This vulnerability is fixed in 2.3.0.

• CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.