CVE-2026-35602 go-vikunja CVE debrief

Who should care

Defenders responsible for Vikunja instances should assess exposure and prioritize updating to version 2.3.0 or later. Security teams should review and adjust file size limits and monitoring to detect potential bypass attempts.

Why it matters

CVE-2026-35602 is a vulnerability in the Vikunja open-source self-hosted task management platform that allows an attacker to bypass the configured maximum file size limit. Defenders should prioritize verifying and updating Vikunja instances to version 2.3.0 or later.

• Potential bypass of file size limits may allow large file uploads, potentially leading to storage issues or exploitation.
• Verification of Vikunja instances and updates to version 2.3.0 or later is necessary to prevent potential bypass.
• Defenders should review and adjust file size limits and monitoring to detect potential bypass attempts.

Technical summary

The Vikunja file import endpoint is vulnerable to a bypass of the configured maximum file size limit. An attacker can manipulate the Size field in the JSON metadata of a zip file to bypass the limit. This issue was fixed in version 2.3.0. Affected deployments should be verified and updated to prevent potential file size limit bypass. The vulnerability allows for large file uploads, potentially leading to storage issues or exploitation. Defenders should prioritize verifying and updating Vikunja instances to version 2.3.0 or later.

Defensive priority

Defenders should prioritize verifying and updating Vikunja instances to version 2.3.0 or later to prevent potential file size limit bypass.

Recommended defensive actions

• Verify and update Vikunja instances to version 2.3.0 or later
• Review and adjust file size limits and monitoring to detect potential bypass attempts
• Implement additional security measures to restrict file imports and validate user input
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fixed version. However, there is limited information on potential exploitation or affected deployments. To address this, defenders should verify and test the affected Vikunja instances to ensure they are updated to version 2.3.0 or later. Additionally, reviewing and adjusting file size limits and monitoring can help detect potential bypass attempts. The lack of detailed information on exploitation or affected deployments necessitates a cautious and

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.