Executive brief
Vikunja is a project management and task tracking application that allows users to export and import their data as compressed archives. A flaw in the import feature fails to limit how much data can be decompressed from an uploaded archive, allowing an authenticated attacker to upload a small file that expands to tens of gigabytes in memory and disk, exhausting server resources and crashing the service for all users.
Technical details
This vulnerability is a decompression bomb (CWE-400: Uncontrolled Resource Consumption) in the data import endpoint (/api/v1/migration/vikunja-file/migrate). The import mechanism accepts ZIP archives but lacks limits on total uncompressed size, file count per archive, or per-user storage quota. Additionally, the server buffers entire decompressed files in memory before writing to disk, causing peak memory consumption to be the sum of all expanded files simultaneously. An attacker with a valid account can craft a highly compressible archive (e.g., ~20 MB of compressed zeros) that expands to tens of gigabytes; the compression ratio enables one file to create thousands of times its compressed size. Multiple imports can be run in parallel without serialization, allowing rapid resource exhaustion. The vulnerability requires authentication but no special privileges, and no user interaction. Patch is available in version 2.6.0.
Affected products
- Vikunja Vikunja before 2.6.0
Timeline
- 2026-08-31: disclosed: GitHub Security Advisory GHSA-w7jp-mf2v-8342 published
- 2026-09-15: advisory: CVE-2026-91979 and NVD entry published
- 2026-09-15: patched: Fixed in version 2.6.0