CVE-2026-33675CWE-918

Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources

Medium · published March 24, 2026

CVSS v3.1
6.4
EPSS
0%
Percentile
33.3
In the wild
Unconfirmed
What it is

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the migration helper functions `DownloadFile` and `DownloadFileWithHeaders` in `pkg/modules/migration/helpers.go` make arbitrary HTTP GET requests without any SSRF protection. When a user triggers a Todoist or Trello migration, file attachment URLs from the third-party API response are passed directly to these functions, allowing an attacker to force the Vikunja server to fetch internal network resources and return the response as a downloadable task attachment. Version 2.2.1 patches the issue.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00401 · 33.3th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-03-24T15:33Z
EPSS history
Timeline
  • 24 MAR 15:33Z
    Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources
    cvelistv5