Executive brief
vikunja is a self-hosted open-source task management and project planning application. The CSV import feature allows authenticated users to bulk-migrate tasks from CSV files. An attacker with valid login credentials can upload a specially crafted CSV file containing millions of tiny records to exhaust the server's memory and crash the API service, denying access to all legitimate users.
Technical details
The vulnerability is a resource exhaustion (CWE-400) in the POST /api/v2/migration/csv/migrate endpoint. The root cause is unbounded row cardinality: while the endpoint enforces a byte-size limit on uploads, it does not limit the number of parsed CSV rows. The code uses csv.Reader.ReadAll() to load all rows into memory as a [][]string array, then allocates a full task object for each row before database insertion. An authenticated attacker can bypass the upload-byte cap by crafting a CSV with millions of single-cell records, amplifying a small request (e.g., 4 MB) into massive memory consumption (e.g., 512 MiB+), triggering out-of-memory errors and API process termination. Authentication is required; the attack vector is network-based and synchronous. Patched in version 2.6.0.
Affected products
- vikunja vikunja >=2.5.0, <2.6.0
Timeline
- 2026-08-31: disclosed
- 2026-09-15: advisory
- 2026-09-15: patched: Version 2.6.0 released with fix