EUVD-2026-270791

fkie_cve-2026-27116

Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, a reflected HTML injection vulnerability exists in the Projects module where the `filter` URL parameter is rendered into the DOM without output encoding when the user clicks "Filter." While `<script>` and `<iframe>` are blocked, `<svg>`, `<a>`, and formatting tags (`<h1>`, `<b>`, `<u>`) render without restriction — enabling SVG-based phishing buttons, external redirect links, and content spoofing within the trusted application origin. Version 2.0.0 fixes this issue.

GHSA-4qgr-4h56-8895 — Vikunja has Reflected HTML Injection via filter Parameter in its Projects Module

Affected: Go: code.vikunja.io/api

## Summary

[Vikunja](https://github.com/go-vikunja/vikunja) is an open-source self-hosted task management platform with 3,300+ GitHub stars. A reflected HTML injection vulnerability exists in the Projects module where the `filter` URL parameter is rendered into the DOM without output encoding when the user clicks "Filter." While `<script>` and `<iframe>` are blocked, `<svg>`, `<a>`, and formatting tags (`<h1>`, `<b>`, `<u>`) render without restriction — enabling SVG-based phishing buttons, external redirect links, and content spoofing within the trusted application origin.

**Attack flow:** Attacker shares a crafted project filter link (routine Vikunja workflow) → victim opens it → victim clicks "Filter" (standard UI action) → phishing content renders inside trusted Vikunja interface.

## Affected Component

| Field | Detail | |---|---| | Application | Vikunja v1.1.0 | | Module | Projects | | Endpoint | `/projects/-1/-1?filter=PAYLOAD&page=1` | | Parameter | `filter` (GET) | | Trigger | Click "Filter" button | | Stack | Go backend, Vue.js + TypeScript frontend | | Blocked | `<script>`, `<iframe>` | | Allowed | `<svg>`, `<a>`, `<rect>`, `<text>`, `<h1>`, `<b>`, `<u>` |

## Proof-of-Concept

### PoC-1: SVG Phishing Button (Highest Impact)

Renders a styled, clickable red button redirecting to attacker domain. Visually indistinguishable from a real UI button.

``` http://localhost:3456/projects/-1/-1?filter=%3Csvg%20width%3D%22400%22%20height%3D%2260%22%3E%3Ca%20href%3D%22http…

Most recent entries from all

EUVD-2026-270791

fkie_cve-2026-27116

GHSA-4qgr-4h56-8895 — Vikunja has Reflected HTML Injection via filter Parameter in its Projects Module