CVE-2026-27819: Vikunja Path Traversal Vulnerability

CVE-2026-27819 Overview

CVE-2026-27819 is a Path Traversal vulnerability affecting Vikunja, an open-source self-hosted task management platform. The vulnerability exists in the restoreConfig function within vikunja/pkg/modules/dump/restore.go, which fails to properly sanitize file paths contained in ZIP archives during the restore operation. This allows attackers with administrative privileges to craft malicious ZIP files that can overwrite arbitrary files on the host system. Additionally, a secondary issue causes a runtime panic when processing malformed archives, resulting in a denial of service condition after the database has been permanently wiped.

Critical Impact

Attackers can achieve arbitrary file overwrite on the host system through path traversal, potentially leading to remote code execution. A malformed archive can also trigger a runtime panic that crashes the application after permanently wiping the database, causing both data loss and service disruption.

Affected Products

• Vikunja versions prior to 2.0.0

Discovery Timeline

• 2026-02-25 - CVE-2026-27819 published to NVD
• 2026-02-25 - Last updated in NVD database

Technical Details for CVE-2026-27819

Vulnerability Analysis

The vulnerability stems from improper input validation in the ZIP archive restoration functionality. The restoreConfig function directly uses the Name attribute from zip.File structs in os.OpenFile calls without validating or sanitizing the path. This classic path traversal pattern (CWE-22) allows attackers to include directory traversal sequences (such as ../) in archived file names, causing files to be written outside the intended extraction directory.

The secondary issue relates to insufficient bounds checking on slices derived from archive contents. The restoration logic assumes a specific directory structure within the ZIP archive. When provided with a minimalist malicious ZIP that doesn't conform to expectations, the code attempts to access an index of len(ms)-2 on an insufficiently populated slice at line 154, triggering a runtime panic. This panic occurs after the database has already been wiped, resulting in permanent data loss combined with service unavailability.

Root Cause

The root cause is twofold: first, the application implicitly trusts metadata provided in user-supplied ZIP archives without validation, directly using file names in file system operations. Second, the restoration code lacks defensive programming practices, failing to validate slice lengths before performing index operations. This combination of path traversal and improper array bounds checking creates both data integrity and availability risks.

Attack Vector

The attack requires network access and high privileges (administrative access to the restore functionality). An attacker with administrative credentials can upload a specially crafted ZIP archive through the restore endpoint. The malicious archive can contain files with path traversal sequences in their names, allowing the attacker to write files anywhere on the file system where the Vikunja process has write permissions. This could be leveraged to overwrite configuration files, plant web shells, or modify application binaries.

For the denial of service variant, an attacker can create a minimal ZIP archive that causes an out-of-bounds array access, crashing the application. The timing of this crash—after database operations have begun—means the database may be left in a wiped or corrupted state.

Detection Methods for CVE-2026-27819

Indicators of Compromise

• Unexpected file modifications outside the Vikunja data directory following restore operations
• Application crashes or restarts coinciding with restore attempts
• Database corruption or unexpected data loss after backup restoration
• ZIP files containing entries with path traversal sequences (../) in restore upload logs

Detection Strategies

• Monitor file system operations from the Vikunja process for writes outside expected directories
• Implement anomaly detection for application crashes following restore endpoint access
• Audit restore operation logs for unusual file paths or archive structures
• Deploy file integrity monitoring on critical system files and application binaries

Monitoring Recommendations

• Enable verbose logging for restore operations and monitor for path traversal patterns
• Set up alerts for Vikunja process crashes, particularly those occurring during restore workflows
• Monitor database health and implement automated backup verification
• Track administrative API endpoint usage for suspicious restore activity patterns

How to Mitigate CVE-2026-27819

Immediate Actions Required

• Upgrade Vikunja to version 2.0.0 or later immediately
• Restrict access to the restore functionality to only trusted administrators
• Implement network-level controls to limit access to administrative endpoints
• Review recent restore operations for signs of exploitation

Patch Information

Version 2.0.0 of Vikunja addresses this vulnerability by implementing proper path sanitization and bounds checking in the restore functionality. The fix ensures that file paths extracted from ZIP archives are validated before use and that array operations include proper length validation. Detailed information about the fix is available in the GitHub Security Advisory and the Vikunja v2.0.0 Release Changelog.

Workarounds

• Disable or restrict access to the restore functionality until the patch can be applied
• Run Vikunja with minimal file system permissions to limit the impact of arbitrary file writes
• Implement a reverse proxy with request filtering to block potentially malicious archive uploads
• Ensure regular database backups are maintained independently of the application's restore feature