CVE-2026-91979

Vikunja, an open-source self-hosted to-do/task-management application, fails to limit archive expansion during its data-import feature in all versions before 2.6.0 (CWE-400). An authenticated user can upload a highly compressed archive (a 'zip bomb') that expands to tens of gigabytes of data in memory and on disk when the server processes the import. This exhausts server resources and crashes or freezes the Vikunja instance, causing denial of service for all users of that deployment; the attacker gains no confidentiality or integrity impact. Any self-hosted or hosted Vikunja instance running a version earlier than 2.6.0 that allows authenticated users to run imports is affected. The flaw is not in the CISA KEV catalog and no public proof-of-concept is known, so exploitation is presumed limited at this time.

What to do: Upgrade to Vikunja 2.6.0 or later, which caps archive expansion during import. If immediate upgrade is not possible, restrict who can use the import feature, enforce upload size and quota limits at the reverse proxy or application level, and monitor server memory and disk usage for spikes following import activity.