Stored Cross-Site Scripting Vulnerability in Vikunja Task Management Platform

CVE-2026-27616

What is CVE-2026-27616?

Vikunja is an open-source task management platform that, prior to version 2.0.0, allowed users to upload SVG files as task attachments. These SVG files, which use XML and can contain executable JavaScript, were not properly sanitized by the application before storage. When accessed, the SVG files would render inline within the user's browser under the application's domain, executing any embedded JavaScript with the privileges of the authenticated user. This flaw exposes the authentication token, stored in localStorage, to potential theft via malicious code in the uploaded SVG files. This vulnerability was addressed in version 2.0.0 of Vikunja.

References