CVE-2026-27116
Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, a reflected HTML injection vulnerability exists in the Projects module where the `filter` URL parameter is rendered into the DOM without output encoding when the user clicks "Filter." While `<script>` and `<iframe>` are blocked, `<svg>`, `<a>`, and formatting tags (`<h1>`, `<b>`, `<u>`) render without restriction — enabling SVG-based phishing buttons, external redirect links, and content spoofing within the trusted application origin. Version 2.0.0 fixes this issue.
- Affected products
- Vikunja
- Vikunja
- < 2.0.0
- Fix
- Available
- CVSS 3.1
- 6.1 MEDIUM
- EPSS
- 0.2% (13th percentile)
- Weakness
- CWE-80, CWE-79
- NVD status
- Analyzed
- Published
- 2026-02-25
No indexed exploits for CVE-2026-27116 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-27116 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.