Vulnerability · Published Nov 8, 2026 · Assigned by VulnCheck
CVE-2026-123510Vikunja before 2.7.1 Plugin and Log Directories Not Anchored to Rootpath
Low 3.3
In plain English
A low-severity uncontrolled search path in vikunja from go-vikunja. There are no confirmed reports of exploitation so far.
Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)–no EPSS score yet
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Vikunja before 2.7.1 fails to re-anchor PluginsDir and LogPath to service.rootpath, allowing plugins to load from and logs to be written in the startup working directory. Local attackers able to write to that directory can plant plugins loaded into the server when plugins are enabled, or read misplaced logs including audit.log.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| go-vikunja | vikunja | 0 – before 2.7.1 |
Weakness: CWE-427 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
References
- GitHub Security Advisory (GHSA-hrw2-p27j-8mj8) vendor-advisory
- VulnCheck Advisory: Vikunja before 2.7.1 Plugin and Log Directories Not Anchored to Rootpath third-party-advisory