CVE-2026-33675 Details
Description
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the migration helper functions `DownloadFile` and `DownloadFileWithHeaders` in `pkg/modules/migration/helpers.go` make arbitrary HTTP GET requests without any SSRF protection. When a user triggers a Todoist or Trello migration, file attachment URLs from the third-party API response are passed directly to these functions, allowing an attacker to force the Vikunja server to fetch internal network resources and return the response as a downloadable task attachment. Version 2.2.1 patches the issue.
A server-side request forgery (SSRF) vulnerability has been identified in Vikunja, an open-source task management platform, in versions prior to 2.2.1. The issue arises in the migration helper functions 'DownloadFile' and 'DownloadFileWithHeaders', which make arbitrary HTTP GET requests without proper SSRF protection. During migrations from Todoist or Trello, file attachment URLs from the third-party API are passed directly to these functions. This allows an attacker to manipulate the Vikunja server into fetching internal network resources and returning the data as a downloadable task attachment. The vulnerability exists because the migration HTTP client uses a standard 'http.Client' without URL validation, private IP blocklisting, redirect restrictions, or response size limits.
Users can upgrade to Vikunja version 2.2.1 or later, where this vulnerability has been patched. The migration module now uses a centralized SSRF protection layer that filters outgoing HTTP requests, preventing the exploitation of this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/go-vikunja/vikunja/security/advisories/GHSA-g66v-54v9-52pr | CISA-ADP | ExploitVendor Advisory |
| https://github.com/go-vikunja/vikunja/commit/93297742236e3d33af72c993e5da960db01d259e | [email protected] | Patch |
| https://github.com/go-vikunja/vikunja/security/advisories/GHSA-g66v-54v9-52pr | [email protected] | ExploitVendor Advisory |
| https://vikunja.io/changelog/vikunja-v2.2.2-was-released | [email protected] | Release Notes |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vikunja vikunja | < 2.2.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 27, 2026 | Initial Analysis | [email protected] |
| Mar 24, 2026 | CVE Modified | CISA-ADP |
| Mar 24, 2026 | New CVE Received | [email protected] |