Executive brief
Vikunja is a popular open-source task management and project planning application. The Planka migration feature allows users to import projects from other task management systems. An authenticated attacker can exploit a memory budgeting flaw to exhaust the server's memory by submitting a migration request pointing to a malicious server that advertises many large attachments. This causes the entire Vikunja service to crash, making it unavailable to all users.
Technical details
The vulnerability is a resource exhaustion (CWE-770) in the Planka migration handler. While Vikunja enforces per-file size limits on individual attachments, it does not cap the aggregate total memory consumed during a migration job. When processing attachments, all downloaded file data is retained in memory simultaneously until the entire hierarchy is inserted. An authenticated attacker can supply a public Planka server URL that advertises many attachments individually under the per-file limit but collectively exceeding available memory. The asynchronous migration request has no deadline and no aggregate budget enforcement. The attack vector is network-based and requires only low-privilege authentication. Exploitation causes an out-of-memory condition that crashes the Vikunja API process and denies service to all users. A patch is available in version 2.6.0.
Affected products
- Vikunja Vikunja before 2.6.0
Timeline
- 2026-08-31: disclosed: GitHub Security Advisory GHSA-wq92-8x3r-fm38 published
- 2026-09-15: advisory: CVE-2026-91970 published on NVD
- 2026-09-15: patched: Fix available in version 2.6.0