The vulnerability allows a user to upload an SVG file that contains executable JavaScript. Because the application stores the file without sanitization and serves it within the same origin, the code runs in the browser of any user who opens the attachment. The attacker can access the authentication token kept in localStorage and exfiltrate it, compromising the user’s account. This is a client‑side code execution flaw that directly harms confidentiality of user credentials and can be leveraged to impersonate the victim.

The flaw exists in all Vikunja installations prior to version 2.0.0. Users of the open‑source self‑hosted task manager, regardless of operating system or deployment environment, are affected until the patch bundled in 2.0.0 or later is applied.

The CVSS score of 7.3 classifies the issue as a high‑severity flaw. While the EPSS score indicates a low probability of exploitation, the vulnerability is not presently listed in the CISA KEV catalog, which suggests no widespread active exploitation observed to date. Enabling attack requires the malicious SVG to be uploaded by a user with permission to add attachments, and for that or another user to open the file in a modern browser that will render the inline script. The attacker’s malicious payload can read the authentication token stored in localStorage and exfiltrate it, thereby compromising the victim’s account.