CVE-2026-33675
Description
Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the migration helper functions `DownloadFile` and `DownloadFileWithHeaders` in `pkg/modules/migration/helpers.go` make arbitrary HTTP GET requests without any SSRF protection. When a user triggers a Todoist or Trello migration, file attachment URLs from the third-party API response are passed directly to these functions, allowing an attacker to force the Vikunja server to fetch internal network resources and return the response as a downloadable task attachment. Version 2.2.1 patches the issue.
How to fix
- vikunja vikunja2.2.1 or later
- code.vikunja.io/api2.2.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vikunja vikunja | v < 2.2.1 | 2.2.1 |
| code.vikunja.io/apiGo | v < 2.2.1, No range specified | 2.2.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.