Vikunja, a self‑hosted task management system, has a flaw that prevents the application from anchoring the directories used for plugins and logs to its configured root path. This means that when the service starts, the default location for plugins and audit.log is the working directory of the process. A local user who can write files in that directory can place arbitrary code in a plugin file and then enable plugin loading, or read the audit logs that may contain sensitive information. This is a classic directory traversal weakness (CWE‑427) that can lead to local code execution and information disclosure.

All installations of Vikunja with a version earlier than 2.7.1 are impacted. The affected product is the open‑source Vikunja application, provided by go‑vikunja. The vulnerability exists whenever plugin loading is enabled and the application is executed from a working directory that a local attacker can write to; there are no vendor‑supplied service restrictions that mitigate the issue.

The CVSS score of 1 indicates a low‑severity rating, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local access to write in the server’s startup directory, which typically means administrative or privileged user rights. Once a malicious plugin is dropped, the server will load it on the next restart, potentially providing arbitrary code execution. Because the flaw only affects local attacks and relies on file‑system permissions, the practical risk is limited, but organizations that run Vikunja with broad write permissions or enable remote plugin installation should treat it as a moderate threat.