CVE-2026-123510
Vikunja before 2.7.1 Plugin and Log Directories Not Anchored to Rootpath
CVSS Score
3.3
EPSS Score
0.0%
EPSS Percentile
0th
Vikunja before 2.7.1 fails to re-anchor PluginsDir and LogPath to service.rootpath, allowing plugins to load from and logs to be written in the startup working directory. Local attackers able to write to that directory can plant plugins loaded into the server when plugins are enabled, or read misplaced logs including audit.log.
| CWE | CWE-427 |
| Vendor | go-vikunja |
| Product | vikunja |
| Published | Nov 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for go-vikunja vikunja
Be the first to know when new low vulnerabilities affecting go-vikunja vikunja are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
go-vikunja / vikunja
0 < 2.7.1