PT-2026-92090

CVE-2026-91971

Published

2026-09-15

Updated

2026-10-19

Description by

CVSS 4.0

7.1

High

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Vikunja versions prior to 2.6.0

Description Authenticated users can cause a denial of service by uploading specially crafted images to the avatar and project-background upload endpoints. The software fails to apply pixel decode limits, allowing images with extreme aspect ratios to consume excessive CPU and memory during processing. This can be triggered through repeated or concurrent uploads.

Recommendations Update to version 2.6.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

7Thparkk

Jellowbeanz26

Str1Ckl4Nd

Vendors

Affected products

Weakness enumeration