File Size Bypass Vulnerability in Vikunja Task Management Platform

CVE-2026-35602

What is CVE-2026-35602?

Vikunja, a self-hosted task management platform, contains a vulnerability that allows attackers to bypass file size restrictions. This occurs when the JSON metadata in a zip import package uses an attacker-controlled Size field, which can be spoofed to 0. As a result, it circumvents the enforcement of configured maximum file size limits, potentially allowing the uploading of excessively large files. The issue has been addressed in version 2.3.0 with the implementation of improved file size validation measures.

References