Vikunja is an open‑source self‑hosted task‑management platform. The migration helper functions DownloadFile and DownloadFileWithHeaders allow the server to perform arbitrary HTTP GET requests without SSRF protection. A user initiating a migration from Todoist or Trello can supply file attachment URLs from the third‑party response that point to internal network resources. The server then fetches those resources and returns them as downloadable attachments, enabling data exposure of internal assets such as configuration files, internal services, or other sensitive resources. The flaw is not a remote code execution or privilege‑elevation issue; it solely permits unauthorized read access to internal data.

The issue affects all Vikunja releases older than version 2.2.1. After applying the patch shipped in Vikunja 2.2.1, the migration functions no longer perform unsanitized external requests. The problem exists only within the Todoist or Trello migration workflow, so systems that have disabled or never used that feature are not exposed.

The CVSS base score is 6.4, placing the vulnerability in the medium‑to‑high range. The EPSS score is below 1 %, indicating a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a user or attacker to trigger a migration that includes a malicious file attachment URL; this can be achieved by compromising a third‑party account or by creating a migration request that includes a crafted URL if the system allows arbitrary URLs. No authentication bypass or elevated privileges are required beyond initiating the migration.