Vikunja’s import endpoint enforced a maximum file size based on the Size value supplied in a zip file’s JSON metadata. An attacker can set this field to 0 while including a large compressed file inside the archive, causing the server to accept the upload and store the large file, thereby bypassing the configured limit. This can consume significant disk or memory resources and lead to service denial. The weakness is an example of resource exhaustion, classified as CWE‑770.

All versions of the Vikunja application released before v2.3.0 are affected, regardless of operating system or deployment environment. The fix was introduced in v2.3.0 and later releases, eliminating the bypass.

The CVSS score of 5.4 indicates medium severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The flaw is exploitable via the HTTP import API. It is inferred that this API requires authentication, though this is not explicitly stated. If an authenticated user can submit an import, the attack can be performed without additional conditions, raising risk in systems where import privileges are widely granted.