CVE-2026-123510: falha de baixa gravidade em go-vikunja vikunja
Vikunja before 2.7.1 Plugin and Log Directories Not Anchored to Rootpath
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
8Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 1epss 0.1%
Vikunja before 2.7.1 fails to re-anchor PluginsDir and LogPath to service.rootpath, allowing plugins to load from and logs to be written in the startup working directory. Local attackers able to write to that directory can plant plugins loaded into the server when plugins are enabled, or read misplaced logs including audit.log.
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
go-vikunja · vikunjaCVEs relacionadas — go-vikunja vikunja
No mesmo produto, das mais perigosas para as menos.
CVE-2026-33336MEDIUMVikunja Desktop vulnerable to Remote Code Execution via same-window navigationEPSS 1.2%CVE-2026-27819HIGHVikunja has Path Traversal in CLI RestoreEPSS 0.8%CVE-2026-28268CRITICALVikunja Vulnerable to Account Takeover via Password Reset Token ReuseEPSS 0.7%CVE-2026-91973HIGHVikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuthEPSS 0.7%CVE-2026-91972HIGHVikunja before 2.6.0 Authentication Bypass via Unthrottled APIEPSS 0.6%CVE-2026-27616HIGHVikunja Vulnerable to Stored Cross-Site Scripting (XSS) via Unsanitized SVG Attachment Upload Leading to Token ExposureEPSS 0.5%