CVE-2026-35602

OVERVIEW: CVE-2026-35602 is a file size validation bypass vulnerability in Vikunja, an open-source self-hosted task management platform. Versions prior to 2.3.0 are affected. The vulnerability exists in the file import endpoint, which fails to properly validate file sizes by relying on attacker-controlled metadata rather than actual decompressed file content. SEVERITY: This vulnerability carries a CVSS score of 7.1 (HIGH) with a network-based attack vector requiring only low complexity and user authentication. The attack has no user interaction requirements. While confidentiality impact is negligible, the vulnerability enables integrity compromise and high availability impact, potentially allowing attackers to overwhelm storage systems or trigger denial-of-service conditions through oversized file uploads that bypass configured upload limits. EXPLOITATION STATUS: The vulnerability is not currently on the CISA Known Exploited Vulnerabilities list and shows no signs of active exploitation in the wild. However, with a CVSS score of 7.1 and low attack complexity, organizations running unpatched Vikunja instances should prioritize upgrading to version 2.3.0 to mitigate this risk. Community attention appears limited, as reflected in the relatively low EPSS percentile ranking.