CVE-2026-91971

Vikunja, an open-source self-hosted task-management platform, versions before 2.6.0 do not apply pixel decode limits when processing avatar and project-background image uploads. An authenticated attacker can upload a small image file crafted with extreme aspect ratios that decodes to an excessive pixel count, consuming significant CPU and memory during processing. Repeated or concurrent uploads of such images can exhaust server resources and cause denial of service for all users of the instance, with no effect on confidentiality or integrity. Any deployment running Vikunja before 2.6.0 that allows authenticated users to upload avatars or project backgrounds is affected. No public proof-of-concept exists, the flaw is not in CISA's KEV catalog, and no exploitation in the wild is known.

What to do: Upgrade to Vikunja 2.6.0 or later, which enforces pixel decode limits on the avatar and project-background upload endpoints. If immediate upgrade is not possible, apply upload rate-limiting for authenticated users and cap request body sizes at the reverse proxy. Check server logs for unusual volumes of image uploads from individual accounts, which would indicate abuse of these endpoints.