CVE-2026-33675: Vikunja Task Management SSRF Vulnerability

CVE-2026-33675 Overview

CVE-2026-33675 is a Server-Side Request Forgery (SSRF) vulnerability in Vikunja, an open-source self-hosted task management platform. The flaw exists in the migration helper functions DownloadFile and DownloadFileWithHeaders located in pkg/modules/migration/helpers.go. These functions issue arbitrary HTTP GET requests without SSRF protection. When a user initiates a Todoist or Trello migration, attachment URLs from the third-party API response are passed directly to these functions. An attacker can force the Vikunja server to fetch internal network resources and return the content as a downloadable task attachment. Vikunja version 2.2.1 patches the issue.

Critical Impact
Authenticated attackers can pivot to internal network resources by abusing Todoist or Trello migration flows to exfiltrate internal HTTP responses through task attachments.

Affected Products

Vikunja versions prior to 2.2.1
Self-hosted Vikunja deployments using Todoist migration
Self-hosted Vikunja deployments using Trello migration

Discovery Timeline

2026-03-24 - CVE-2026-33675 published to NVD
2026-03-27 - Last updated in NVD database

Technical Details for CVE-2026-33675

Vulnerability Analysis

The vulnerability is classified under [CWE-918] Server-Side Request Forgery. Vikunja supports importing tasks from third-party services such as Todoist and Trello. During migration, the third-party API returns task data that includes attachment URLs. The migration helper functions DownloadFile and DownloadFileWithHeaders accept these URLs and perform HTTP GET requests directly. The functions do not validate the destination host, scheme, or IP range. An authenticated user who controls the data returned by the third-party API, or who supplies a crafted migration payload, can substitute attachment URLs pointing at internal services. The Vikunja server then fetches those URLs and stores the response body as a task attachment, which the attacker downloads.

Root Cause

The root cause is missing URL validation in pkg/modules/migration/helpers.go. The helpers trust attachment URLs from external migration sources without enforcing an allowlist or blocking private address ranges such as 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, link-local 169.254.0.0/16, or cloud metadata endpoints like 169.254.169.254.

Attack Vector

Exploitation requires an authenticated user with permission to trigger a Todoist or Trello migration. The attacker hosts or manipulates a migration source so that attachment URLs point to internal targets. The server fetches each URL and exposes the response as a downloadable attachment. This enables internal port scanning, reading cloud instance metadata, and accessing unauthenticated internal HTTP services reachable from the Vikunja host. Refer to the GitHub Security Advisory GHSA-g66v-54v9-52pr for technical details.

Detection Methods for CVE-2026-33675

Indicators of Compromise

Outbound HTTP requests from the Vikunja process targeting RFC1918 addresses, loopback, or cloud metadata endpoints such as 169.254.169.254
Task attachments containing internal HTTP response bodies, error pages, or service banners
Unusual volume of migration jobs initiated by a single account against Todoist or Trello sources

Detection Strategies

Inspect Vikunja application and reverse proxy logs for migration endpoint usage correlated with internal destination IPs
Review stored task attachments for content that resembles internal service responses rather than user files
Alert on any DNS resolution from the Vikunja host that returns private or link-local addresses during migration jobs

Monitoring Recommendations

Forward Vikunja logs and host network telemetry to a centralized SIEM for correlation
Monitor egress traffic from the Vikunja server with deny-by-default policies for internal ranges
Track the version banner of deployed Vikunja instances to identify unpatched hosts

How to Mitigate CVE-2026-33675

Immediate Actions Required

Upgrade Vikunja to version 2.2.1 or later as documented in the Vikunja Release Changelog v2.2.2
Audit existing task attachments created through Todoist or Trello migrations for suspicious internal content
Restrict migration features to trusted users until the upgrade is complete

Patch Information

The fix is delivered in Vikunja 2.2.1 via commit 93297742236e3d33af72c993e5da960db01d259e. The patch adds SSRF protection to DownloadFile and DownloadFileWithHeaders so that requests to private and reserved networks are rejected. Review the GitHub Commit Record for the exact code changes.

Workarounds

Block outbound traffic from the Vikunja server to RFC1918, loopback, and link-local ranges at the network layer
Deploy an egress HTTP proxy that enforces an allowlist of external migration endpoints such as the Todoist and Trello APIs
Disable the Todoist and Trello migration modules in Vikunja configuration if migrations are not required

bash

# Configuration example: restrict Vikunja egress with iptables
iptables -A OUTPUT -m owner --uid-owner vikunja -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner vikunja -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner vikunja -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner vikunja -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner vikunja -d 169.254.0.0/16 -j REJECT