CVE-2026-27616: Vikunja cross-site scripting (XSS) (CVSS 7.3)

Description

Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the application allows users to upload SVG files as task attachments. SVG is an XML-based format that supports JavaScript execution through elements such as <script> tags or event handlers like onload. The application does not sanitize SVG content before storing it. When the uploaded SVG file is accessed via its direct URL, it is rendered inline in the browser under the application's origin. As a result, embedded JavaScript executes in the context of the authenticated user. Because the authentication token is stored in localStorage, it is accessible via JavaScript and can be retrieved by a malicious payload. Version 2.0.0 patches this issue.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredLow

User interactionRequired

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityNone

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Affected products

Vikunja< 2.0.0

Remediation

Fixed in

Vikunja≥ 2.0.0

Patch & vendor advisories

https://github.com/go-vikunja/vikunja/security/advisories/GHSA-7jp5-298q-jg98

References

https://github.com/go-vikunja/vikunja/security/advisories/GHSA-7jp5-298q-jg98Vendor Advisory
https://github.com/user-attachments/files/25414870/Stored.XSS.Proof.of.concept.pdfExploitThird Party Advisory
https://vikunja.io/changelog/vikunja-v2.0.0-was-releasedRelease Notes

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-27616 being actively exploited?

CVE-2026-27616 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 0.64%.

How severe is CVE-2026-27616?

CVE-2026-27616 has a CVSS 3.1 base score of 7.3, rated high. EPSS estimates a 0.64% probability of exploitation.

Which products are affected by CVE-2026-27616?

Affected products include Vikunja.

How do I fix CVE-2026-27616?

Upgrade affected software to a fixed version, for example Vikunja 2.0.0 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-27616 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo