CVE-2026-27616

Received Received - Intake

Stored XSS via Unsanitized SVG Uploads in Vikunja Before

Publication date: 2026-02-25

Last updated on: 2026-03-05

Assigner: GitHub, Inc.

Description

Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the application allows users to upload SVG files as task attachments. SVG is an XML-based format that supports JavaScript execution through elements such as <script> tags or event handlers like onload. The application does not sanitize SVG content before storing it. When the uploaded SVG file is accessed via its direct URL, it is rendered inline in the browser under the application's origin. As a result, embedded JavaScript executes in the context of the authenticated user. Because the authentication token is stored in localStorage, it is accessible via JavaScript and can be retrieved by a malicious payload. Version 2.0.0 patches this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-02-25

Last Modified

2026-03-05

Generated

2026-07-06

AI Q&A

2026-02-26

EPSS Evaluated

2026-07-05

NVD

CVE-2026-27616

EUVD

EUVD-2026-8752

Affected Vendors & Products

Vendor	Product	Version / Range
vikunja	vikunja	to 2.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Vikunja, an open-source self-hosted task management platform, prior to version 2.0.0. The application allows users to upload SVG files as task attachments without sanitizing the SVG content. Since SVG files are XML-based and can contain executable JavaScript through elements like <script> tags or event handlers such as onload, malicious JavaScript embedded in an uploaded SVG can execute when the file is accessed via its direct URL.

Because the SVG is rendered inline in the browser under the application's origin, the embedded JavaScript runs in the context of the authenticated user. This allows the malicious script to access sensitive data such as the authentication token stored in localStorage, potentially leading to unauthorized actions.

This issue was fixed in version 2.0.0 by patching the handling of SVG uploads.

Impact Analysis

This vulnerability can lead to the execution of malicious JavaScript code in the context of an authenticated user. As a result, an attacker can steal the user's authentication token stored in localStorage.

With the stolen token, the attacker could impersonate the user, gaining unauthorized access to the application and potentially sensitive task data.

This can lead to data breaches, unauthorized actions within the application, and compromise of user accounts.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, upgrade Vikunja to version 2.0.0 or later, as this version patches the issue by preventing unsafe SVG content from executing embedded JavaScript.

Additionally, avoid uploading SVG files as task attachments until the upgrade is applied, or implement server-side sanitization of SVG files to remove any embedded scripts or event handlers.

Hi! I’m here to help you understand CVE-2026-27616. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70