CVE-2026-35601 Details
Description
Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CalDAV output generator builds iCalendar VTODO entries via raw string concatenation without applying RFC 5545 TEXT value escaping. User-controlled task titles containing CRLF characters break the iCalendar property boundary, allowing injection of arbitrary iCalendar properties such as ATTACH, VALARM, or ORGANIZER. This vulnerability is fixed in 2.3.0.
A vulnerability in Vikunja, an open-source task management platform, allows for iCalendar property injection through CRLF character manipulation in task titles. This issue exists in versions prior to 2.3.0. The CalDAV output generator concatenates task summaries into iCalendar VTODO entries without proper escaping, as required by RFC 5545. User-controlled titles with CRLF characters can disrupt the iCalendar property structure, enabling the injection of arbitrary properties like ATTACH, VALARM, or ORGANIZER.
Users are advised to update Vikunja to version 2.3.0, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/go-vikunja/vikunja/security/advisories/GHSA-2g7h-7rqr-9p4r | CISA-ADP | ExploitVendor Advisory |
| https://github.com/go-vikunja/vikunja/pull/2580 | [email protected] | Issue Tracking |
| https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0 | [email protected] | Release Notes |
| https://github.com/go-vikunja/vikunja/security/advisories/GHSA-2g7h-7rqr-9p4r | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-93 | Improper Neutralization of CRLF Sequences ('CRLF Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vikunja vikunja | < 2.3.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 17, 2026 | Initial Analysis | [email protected] |
| Apr 13, 2026 | CVE Modified | CISA-ADP |
| Apr 10, 2026 | New CVE Received | [email protected] |