vulnerability · Fri 09 Oct 2026 · 20:52 UTC
GHSA-4vh2-39rq-rq8j: Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification
Filed UTCSource GTH ↗
The 50-megapixel decode guard exists only on the task-attachment preview path. Avatar and project-background uploads decode uploaded images with no pixel cap. Worse, the avatar resize fixes the output height at 1024 and derives the width from the aspect ratio, so a tiny extreme-aspect-ratio PNG expands to an enormous output image — an input-side pixel cap would not catch it. ### Details The only maxPixels check (50MP) is in TaskAttachment.GetPreview (pkg/models/task_attachment.go ~lines 332-338). …
Signals
as the pipeline stamped them- High
- High-risk vulnerability
CVE
KEV from CISA · EPSS from FIRST| Id | KEV | EPSS | Reference |
|---|---|---|---|
| CVE-2026-91971 | — | 0.44% | NVD ↗ |
Get the next one first.
Every dispatch goes to Telegram and RSS the moment it is published, and the whole wire is a keyless JSON API.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.