What is GHSA-5gjc-rq8x-g8fj?

GHSA-5gjc-rq8x-g8fj is a security advisory published by GitHub Security Advisories with High severity. Vikunja before 2.7.1 contains a resource exhaustion vulnerability in the vikunja-file ZIP...

Which CVE IDs does GHSA-5gjc-rq8x-g8fj cover?

GHSA-5gjc-rq8x-g8fj covers the following CVE IDs: CVE-2026-123516. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-5gjc-rq8x-g8fj?

GHSA-5gjc-rq8x-g8fj has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

GHSA-5gjc-rq8x-g8fjHighCVSS 4.3

Vikunja before 2.7.1 contains a resource exhaustion vulnerability in the vikunja-file ZIP...

Vendor

GitHub Security Advisories

Published

November 8, 2026

Last Modified

November 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-123516 →

📋 Description

Vikunja before 2.7.1 contains a resource exhaustion vulnerability in the vikunja-file ZIP importer that allows authenticated users to consume CPU and memory by uploading archives with excessive entries. Attackers can upload export ZIPs containing many empty or non-files/ entries that bypass the per-entry caps, forcing scanArchive to process every entry twice.

🔗 References (4)

https://github.com/go-vikunja/vikunja/security/advisories/GHSA-mqq8-869v-48q8
https://nvd.nist.gov/vuln/detail/CVE-2026-123516
https://www.vulncheck.com/advisories/vikunja-before-2.7.1-resource-exhaustion-via-vikunja-file-zip-import
https://github.com/advisories/GHSA-5gjc-rq8x-g8fj