CVE-2026-33675: Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources
The migration helper functions DownloadFile and DownloadFileWithHeaders in pkg/modules/migration/helpers.go make arbitrary HTTP GET requests without any SSRF protection. When a user triggers a Todoist or Trello migration, file attachment URLs from the third-party API response are passed directly to these functions, allowing an attacker to force the Vikunja server to fetch internal network resources and return the response as a downloadable task attachment.
References
- github.com/advisories/GHSA-g66v-54v9-52pr
- github.com/go-vikunja/vikunja
- github.com/go-vikunja/vikunja/commit/93297742236e3d33af72c993e5da960db01d259e
- github.com/go-vikunja/vikunja/security/advisories/GHSA-g66v-54v9-52pr
- nvd.nist.gov/vuln/detail/CVE-2026-33675
- vikunja.io/changelog/vikunja-v2.2.2-was-released
Code Behaviors & Features
Detect and mitigate CVE-2026-33675 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →