CVE-2026-27116
Medium · 6.1CVSS
6.1
EPSS
0.3%
Published
Feb 25, 2026
CISA due date
—
The record
Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, a reflected HTML injection vulnerability exists in the Projects module where the `filter` URL parameter is rendered into the DOM without output encoding when the user clicks "Filter." While `<script>` and `<iframe>` are blocked, `<svg>`, `<a>`, and formatting tags (`<h1>`, `<b>`, `<u>`) render without restriction — enabling SVG-based phishing buttons, external redirect links, and content spoofing within the trusted application origin. Version 2.0.0 fixes this issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | code.vikunja.io/api | 0 | No fix |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260317T205859-150000.1.152.1 |
Related vulnerabilities
- GHSA-4qgr-4h56-8895 Vikunja has Reflected HTML Injection via filter Parameter in its Projects Module Same vulnerability
- GHSA-rfjg-6m84-crj2 Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse Also affects code.vikunja.io/api
- CVE-2026-28268 Vikunja is an open-source self-hosted task management platform. Also affects code.vikunja.io/api
- GHSA-42wg-38gx-85rh Vikunja has Path Traversal in CLI Restore Also affects code.vikunja.io/api
- GHSA-7jp5-298q-jg98 Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure Also affects code.vikunja.io/api
- CVE-2026-27819 Vikunja is an open-source self-hosted task management platform. Also affects code.vikunja.io/api
- CVE-2026-27575 Vikunja is an open-source self-hosted task management platform. Also affects code.vikunja.io/api
- CVE-2026-27616 Vikunja is an open-source self-hosted task management platform. Also affects code.vikunja.io/api