https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 18 Oct 2026 02:56:35 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-277243 EUVD-2026-277243 https://cve.radiocsirt.org/vuln/euvd-2026-277243 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33675 <p>Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the migration helper functions `DownloadFile` and `DownloadFileWithHeaders` in `pkg/modules/migration/helpers.go` make arbitrary HTTP GET requests without any SSRF protection. When a user triggers a Todoist or Trello migration, file attachment URLs from the third-party API response are passed directly to these functions, allowing an attacker to force the Vikunja server to fetch internal network resources and return the response as a downloadable task attachment. Version 2.2.1 patches the issue.</p> <p>Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the migration helper functions `DownloadFile` and `DownloadFileWithHeaders` in `pkg/modules/migration/helpers.go` make arbitrary HTTP GET requests without any SSRF protection. When a user triggers a Todoist or Trello migration, file attachment URLs from the third-party API response are passed directly to these functions, allowing an attacker to force the Vikunja server to fetch internal network resources and return the response as a downloadable task attachment. Version 2.2.1 patches the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-33675 https://cve.radiocsirt.org/vuln/ghsa-g66v-54v9-52pr <p><strong>Affected:</strong> Go: code.vikunja.io/api</p> <p>## Summary</p> <p>The migration helper functions `DownloadFile` and `DownloadFileWithHeaders` in `pkg/modules/migration/helpers.go` make arbitrary HTTP GET requests without any SSRF protection. When a user triggers a Todoist or Trello migration, file attachment URLs from the third-party API response are passed directly to these functions, allowing an attacker to force the Vikunja server to fetch internal network resources and return the response as a downloadable task attachment.</p> <p>## Details</p> <p>The vulnerability exists because the migration HTTP client uses a plain `http.Client{}` with no URL validation, no private IP blocklist, no redirect restrictions, and no response size limit.</p> <p>**Vulnerable code** in `pkg/modules/migration/helpers.go:38-59`: ```go func DownloadFileWithHeaders(url string, headers http.Header) (buf *bytes.Buffer, err error) { req, err := http.NewRequestWithContext(context.Background(), http.MethodGet, url, nil) if err != nil { return nil, err } // ... headers added ... hc := http.Client{} resp, err := hc.Do(req) // ... no URL validation, no IP filtering ... buf = &amp;bytes.Buffer{} _, err = buf.ReadFrom(resp.Body) // no size limit return } ```</p> <p>**Call site in Todoist migration** (`pkg/modules/migration/todoist/todoist.go:433-435`): ```go if len(n.FileAttachment.FileURL) &gt; 0 { buf, err := migration.DownloadFile(n.FileAttachment.FileURL) ```</p> <p>The `FileURL` is deserialized directly from the Todoist Sync API response (`json:&#34;file_url&#34;` tag at line 125) with…</p> <p><strong>Affected:</strong> Go: code.vikunja.io/api</p> <p>## Summary</p> <p>The migration helper functions `DownloadFile` and `DownloadFileWithHeaders` in `pkg/modules/migration/helpers.go` make arbitrary HTTP GET requests without any SSRF protection. When a user triggers a Todoist or Trello migration, file attachment URLs from the third-party API response are passed directly to these functions, allowing an attacker to force the Vikunja server to fetch internal network resources and return the response as a downloadable task attachment.</p> <p>## Details</p> <p>The vulnerability exists because the migration HTTP client uses a plain `http.Client{}` with no URL validation, no private IP blocklist, no redirect restrictions, and no response size limit.</p> <p>**Vulnerable code** in `pkg/modules/migration/helpers.go:38-59`: ```go func DownloadFileWithHeaders(url string, headers http.Header) (buf *bytes.Buffer, err error) { req, err := http.NewRequestWithContext(context.Background(), http.MethodGet, url, nil) if err != nil { return nil, err } // ... headers added ... hc := http.Client{} resp, err := hc.Do(req) // ... no URL validation, no IP filtering ... buf = &amp;bytes.Buffer{} _, err = buf.ReadFrom(resp.Body) // no size limit return } ```</p> <p>**Call site in Todoist migration** (`pkg/modules/migration/todoist/todoist.go:433-435`): ```go if len(n.FileAttachment.FileURL) &gt; 0 { buf, err := migration.DownloadFile(n.FileAttachment.FileURL) ```</p> <p>The `FileURL` is deserialized directly from the Todoist Sync API response (`json:&#34;file_url&#34;` tag at line 125) with…</p> https://cve.radiocsirt.org/vuln/ghsa-g66v-54v9-52pr