CVE-2026-35601

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CalDAV output generator builds iCalendar VTODO entries via raw string concatenation without applying RFC 5545 TEXT value escaping. User-controlled task titles containing CRLF characters break the iCalendar property boundary, allowing injection of arbitrary iCalendar properties such as ATTACH, VALARM, or ORGANIZER. This vulnerability is fixed in 2.3.0.

Score
CVSS 3.1 4.1 Medium
Status
Analyzed - security-advisories@github.com
Published
2026-04-10
Last modified
2026-10-26
Weaknesses
CWE-93

Affected products

References

 
 
© AVABIS GmbH privacypolicy about