VulnerabilityAnalyzed

CVE-2026-33679

Prior to version 2.2.1, the `DownloadImage` function in `pkg/utils/avatar.go` uses a bare `http.Client{}` with no SSRF protection when downloading user avatar images from the OpenID Connect `picture` claim URL.

HIGH 7.4EPSS 0.40%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.40%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the `DownloadImage` function in `pkg/utils/avatar.go` uses a bare `http.Client{}` with no SSRF protection when downloading user avatar images from the OpenID Connect `picture` claim URL. An attacker who controls their OIDC profile picture URL can force the Vikunja server to make HTTP GET requests to arbitrary internal or cloud metadata endpoints. This bypasses the SSRF protections that are correctly applied to the webhook system. Version 2.2.1 patches the issue.

CVSS 3.1: 7.4 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
EPSS: 0.40% probability · 33th percentile
CISA KEV: Not listed
Weakness: CWE-918
Affected: vikunja/vikunja
Source: security-advisories@github.com

References

https://github.com/go-vikunja/vikunja/commit/363aa6642352b08fc8bc6aaff2f3a550393af1cfPatch
https://github.com/go-vikunja/vikunja/security/advisories/GHSA-g9xj-752q-xh63Exploit, Vendor Advisory
https://vikunja.io/changelog/vikunja-v2.2.2-was-releasedRelease Notes

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.