CVE-2026-35602 Details

A vulnerability in Vikunja's file import feature allows authenticated users to bypass the maximum file size limit. This issue affects Vikunja versions prior to 2.3.0. The vulnerability arises because the import endpoint relies on the 'Size' field from the JSON metadata of the import zip, which can be manipulated by attackers. By setting the 'Size' to 0 while including large compressed files, an attacker can exploit this flaw to upload files that exceed the server's size restrictions, potentially leading to a denial-of-service condition by filling up server storage.

Users can update to Vikunja version 2.3.0, which addresses this vulnerability by ensuring that the file size enforcement check uses the actual decompressed file length instead of the attacker-controlled 'Size' field.