Description
Vikunja before 2.7.1 contains an insecure file permissions vulnerability that allows local users to read stored data because localStorage.Write creates blobs world-readable. Local attackers on a shared host can read attachments, project backgrounds and exports, and copy the SQLite database to crack password hashes offline.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| go-vikunja | vikunja | < 2.7.1 | 2.7.1 |
References
- GitHub Security Advisory (GHSA-9rfw-7hv4-3vv3) vendor-advisory
- VulnCheck Advisory: Vikunja before 2.7.1 World-Readable Local File Storage and SQLite Database third-party-advisory