wger uncontrolled resource consumption in workout routine date sequence

Executive brief

wger, an open-source workout and fitness manager, is vulnerable to a denial-of-service attack. An authenticated user can create a workout routine spanning an excessive amount of time (such as 100 years), which forces the server to perform massive calculations whenever that routine is accessed. This can exhaust server resources, making the application slow or completely unavailable for all other users.

Technical details

The vulnerability exists in the Routine model and its associated API endpoints due to a lack of validation on the duration between 'start' and 'end' dates. An authenticated attacker can create a routine spanning decades, which triggers an unbounded while loop in the 'date_sequence' property (wger/manager/models/routine.py). This loop performs O(days x slots x configs) work per request. Affected endpoints include date-sequence-display, date-sequence-gym, structure, logs, and stats. Repeated requests can exhaust server worker threads and CPU, resulting in a denial of service (DoS). The issue affects wger versions up to and including 2.5.

Affected products

• wger-project wger <= 2.5

Timeline

• 2026-05-08: advisory: Initial GitHub Advisory publication
• 2026-05-13: disclosed: Advisory updated and finalized

References

• https://api.github.com/users/KadirArslan
• https://github.com/KadirArslan
• https://api.github.com/users/KadirArslan/gists%7B/gist_id%7D
• https://api.github.com/users/KadirArslan/repos
• https://avatars.githubusercontent.com/u/35239791?v=4
• https://api.github.com/users/KadirArslan/events%7B/privacy%7D