Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the migration helper functions `DownloadFile` and `DownloadFileWithHeaders` in `pkg/modules/migration/helpers.go` make arbitrary HTTP GET requests without any SSRF protection. When a user triggers a Todoist or Trello migration, file attachment URLs from the third-party API response are passed directly to these functions, allowing an attacker to force the Vikunja server to fetch internal network resources and return the response as a downloadable task attachment. Version 2.2.1 patches the issue.

Affected: Go: code.vikunja.io/api

## Summary

The migration helper functions `DownloadFile` and `DownloadFileWithHeaders` in `pkg/modules/migration/helpers.go` make arbitrary HTTP GET requests without any SSRF protection. When a user triggers a Todoist or Trello migration, file attachment URLs from the third-party API response are passed directly to these functions, allowing an attacker to force the Vikunja server to fetch internal network resources and return the response as a downloadable task attachment.

## Details

The vulnerability exists because the migration HTTP client uses a plain `http.Client{}` with no URL validation, no private IP blocklist, no redirect restrictions, and no response size limit.

**Vulnerable code** in `pkg/modules/migration/helpers.go:38-59`: ```go func DownloadFileWithHeaders(url string, headers http.Header) (buf *bytes.Buffer, err error) { req, err := http.NewRequestWithContext(context.Background(), http.MethodGet, url, nil) if err != nil { return nil, err } // ... headers added ... hc := http.Client{} resp, err := hc.Do(req) // ... no URL validation, no IP filtering ... buf = &bytes.Buffer{} _, err = buf.ReadFrom(resp.Body) // no size limit return } ```

**Call site in Todoist migration** (`pkg/modules/migration/todoist/todoist.go:433-435`): ```go if len(n.FileAttachment.FileURL) > 0 { buf, err := migration.DownloadFile(n.FileAttachment.FileURL) ```

The `FileURL` is deserialized directly from the Todoist Sync API response (`json:"file_url"` tag at line 125) with…