LOW 1.0 NVD
CVE-2026-123510
Vikunja before 2.7.1 fails to re-anchor PluginsDir and LogPath to service.rootpath, allowing plugins to load from and logs to be written in the startup working
Vikunja before 2.7.1 fails to re-anchor PluginsDir and LogPath to service.rootpath, allowing plugins to load from and logs to be written in the startup working directory. Local attackers able to write to that directory can plant plugins loaded into the server when plugins are enabled, or read misplaced logs including audit.log.
References
- https://github.com/go-vikunja/vikunja/security/advisories/GHSA-hrw2-p27j-8mj8
- https://www.vulncheck.com/advisories/vikunja-before-2.7.1-plugin-and-log-directories-not-a
This low severity vulnerability with a CVSS score of 1.0 was published on 2026-11-08 via NVD.
vulnfeed aggregates 16937 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.