ZeroDay Findings
Sign inSign up

Findings

CVE-2026-33675

Vikunja is an open-source self-hosted task management platform.

Published Mar 24, 2026 · updated Jun 17, 2026 · vikunja vikunja

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the migration helper functions and in make arbitrary HTTP GET requests without any SSRF protection. When a user triggers a Todoist or Trello migration, file attachment URLs from the third-party API response are passed directly to these functions, allowing an attacker to force the Vikunja server to fetch internal network resources and return the response as a downloadable task attachment. Version 2.2.1 patches the issue.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 24, 2026 · NIST NVD

    Detected

    Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the migration helper functions and in make arbitrary HTTP GET requests without any SSRF protection. When a user triggers a Todoist or Trello migration, file attachment URLs from the third-party API response are passed directly to these functions, allowing an attacker to force the Vikunja server to fetch interna

  2. Jun 17, 2026 · NIST NVD

    Updated

    Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the migration helper functions and in make arbitrary HTTP GET requests without any SSRF protection. When a user triggers a Todoist or Trello migration, file attachment URLs from the third-party API response are passed directly to these functions, allowing an attacker to force the Vikunja server to fetch interna

Affected

  • cpe vikunja/vikunjaversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-33675

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-33675

    Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the migration helper functions and in make arbitrary HTTP GET requests without any SSRF protection. When a user trig

    nvd.nist.gov

References