Plugin Directory Misconfiguration in Vikunja by Vikunja
CVE-2026-123510

1LOW

Key Information:

Vendor

Go-vikunja

Status
Vikunja
Vendor
CVE Published:
8 November 2026

What is CVE-2026-123510?

Vikunja versions prior to 2.7.1 are susceptible due to a misconfiguration that fails to correctly anchor the PluginsDir and LogPath to the service's rootpath. This oversight allows local attackers with write access to the startup working directory to load malicious plugins when enabled and access sensitive log files, including audit logs, that may contain critical operational details.

Affected Version(s)

vikunja 0 < 2.7.1

vikunja 2.7.1

References

https://github.com/go-vikunja/vikunja/security/advisories...
vendor-advisory
https://www.vulncheck.com/advisories/vikunja-before-2.7.1...
third-party-advisory

CVSS V4

Score:
1
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Local
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.