CVE-2026-27616

Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the application allows users to upload SVG files as task attachments. SVG is an XML-based format that supports JavaScript execution through elements such as <script> tags or event handlers like onload. The application does not sanitize SVG content before storing it. When the uploaded SVG file is accessed via its direct URL, it is rendered inline in the browser under the application's origin. As a result, embedded JavaScript executes in the context of the authenticated user. Because the authentication token is stored in localStorage, it is accessible via JavaScript and can be retrieved by a malicious payload. Version 2.0.0 patches this issue.

• CWE-79

• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-7jp5-298q-jg98Vendor Advisory
• https://github.com/user-attachments/files/25414870/Stored.XSS.Proof.of.concept.pdfExploit, Third Party Advisory
• https://vikunja.io/changelog/vikunja-v2.0.0-was-releasedRelease Notes

Published

Feb 25, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27610Parse Dashboard is a standalone dashboard for managing Parse…5.3
• CVE-2026-27611FileBrowser Quantum is a free, self-hosted, web-based file m…6.5
• CVE-2026-27612Repostat is a React component to fetch and display GitHub re…6.1
• CVE-2026-27613TinyWeb is a web server (HTTP, HTTPS) written in Delphi for …9.8
• CVE-2026-27614Bugsink is a self-hosted error tracking tool. In versions pr…6.1
• CVE-2026-27615ADB Explorer is a fluent UI for ADB on Windows. In versions …7.8
• CVE-2026-2762Integer overflow in the JavaScript: Standard Library compone…9.8
• CVE-2026-27621TypiCMS is a multilingual content management system based on…5.4
• CVE-2026-27622OpenEXR provides the specification and reference implementat…7.8
• CVE-2026-27623Valkey is a distributed key-value database. Starting in vers…7.5
• CVE-2026-27624Coturn is a free open source implementation of TURN and STUN…6.5
• CVE-2026-27625Stirling-PDF is a locally hosted web application that perfor…6.5