Description
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the migration helper functions `DownloadFile` and `DownloadFileWithHeaders` in `pkg/modules/migration/helpers.go` make arbitrary HTTP GET requests without any SSRF protection. When a user triggers a Todoist or Trello migration, file attachment URLs from the third-party API response are passed directly to these functions, allowing an attacker to force the Vikunja server to fetch internal network resources and return the response as a downloadable task attachment. Version 2.2.1 patches the issue.
INFO
Published Date :
2026-03-24T15:33:05.868Z
Last Modified :
2026-03-24T18:15:30.530Z
Source :
GitHub_M
AFFECTED PRODUCTS
The following products are affected by CVE-2026-33675 vulnerability.
| Vendors | Products |
|---|---|
| Go-vikunja |
|
| Vikunja |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2026-33675.
