Executive brief
Vikunja is a self-hosted task management and project planning platform. Before version 2.6.0, the application fails to limit image decoding on avatar and project-background uploads, allowing authenticated users to submit specially crafted tiny images that expand to enormous pixel dimensions during processing. Attackers can repeatedly upload these malicious images to exhaust server CPU and memory resources, disrupting service availability for all users.
Technical details
The vulnerability is an uncontrolled resource consumption flaw (CWE-400) in Vikunja's image upload handling. The application enforces a 50-megapixel decode limit only on task attachment preview paths, but omits this check on avatar upload (pkg/modules/avatar/upload/upload.go) and project-background upload (pkg/modules/background/handler/background.go) endpoints. Additionally, the avatar resize function fixes output height at 1024 pixels and derives width from input aspect ratio, allowing a 20000×10 PNG (681 bytes) to expand to ~2.1 billion pixels during processing. An authenticated attacker can upload small files that trigger disproportionate CPU and memory consumption; repeated or concurrent uploads cause denial of service. The vulnerability requires authentication but no user interaction. Patches are available in version 2.6.0 and later.
Affected products
- Vikunja Vikunja before 2.6.0
Timeline
- 2026-08-31: disclosed
- 2026-09-15: patched: Version 2.6.0 released