CVE-2026-27616
Stored XSS via Unsanitized SVG Uploads in Vikunja Before
Publication date: 2026-02-25
Last updated on: 2026-03-05
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| vikunja | vikunja | to 2.0.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Vikunja, an open-source self-hosted task management platform, prior to version 2.0.0. The application allows users to upload SVG files as task attachments without sanitizing the SVG content. Since SVG files are XML-based and can contain executable JavaScript through elements like <script> tags or event handlers such as onload, malicious JavaScript embedded in an uploaded SVG can execute when the file is accessed via its direct URL.
Because the SVG is rendered inline in the browser under the application's origin, the embedded JavaScript runs in the context of the authenticated user. This allows the malicious script to access sensitive data such as the authentication token stored in localStorage, potentially leading to unauthorized actions.
This issue was fixed in version 2.0.0 by patching the handling of SVG uploads.
How can this vulnerability impact me? :
This vulnerability can lead to the execution of malicious JavaScript code in the context of an authenticated user. As a result, an attacker can steal the user's authentication token stored in localStorage.
With the stolen token, the attacker could impersonate the user, gaining unauthorized access to the application and potentially sensitive task data.
This can lead to data breaches, unauthorized actions within the application, and compromise of user accounts.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade Vikunja to version 2.0.0 or later, as this version patches the issue by preventing unsafe SVG content from executing embedded JavaScript.
Additionally, avoid uploading SVG files as task attachments until the upgrade is applied, or implement server-side sanitization of SVG files to remove any embedded scripts or event handlers.