CVE-2026-27819: 
NixOS vulnerability analysis and mitigation

CVE-2026-27819 is a path traversal (Zip Slip) and denial-of-service vulnerability in Vikunja, an open-source self-hosted task management platform. The flaw exists in the restoreConfig function within pkg/modules/dump/restore.go and allows a high-privileged attacker to overwrite arbitrary files on the host system via a maliciously crafted ZIP archive, or trigger a runtime panic that permanently wipes the database. All versions prior to 2.0.0 (including code.vikunja.io/api up to v0.24.6) are affected; version 2.0.0 contains the fix. The vulnerability carries a CVSS v3.1 base score of 7.2 (High) (Github Advisory, Vikunja Advisory).

The root cause is twofold, classified under CWE-22 (Path Traversal) and CWE-248 (Uncaught Exception). The Restore function uses the Name attribute of zip.File structs directly in os.OpenFile calls without sanitization, enabling a "Zip Slip" attack where entries with paths like ../../../pwned.txt are written outside the intended extraction directory. Additionally, the restoration logic does not validate the length of the migration slice before performing index arithmetic at line 154 (ms[len(ms)-2]), causing a runtime panic when an insufficiently populated archive is provided. Critically, the database wipe (db.WipeEverything()) occurs before archive validation, meaning even a failed or partial exploit results in permanent data loss. A public proof-of-concept Python script that generates a malicious ZIP is included in the security advisory (Vikunja Advisory, Fix Commit).

Successful exploitation by a high-privileged attacker can result in arbitrary file write on the host system, enabling potential overwrite of configuration files, binaries, or SSH keys, which could lead to full system compromise. The secondary attack vector — providing a malformed ZIP — causes the application to permanently wipe its database before crashing, resulting in complete and irreversible data loss for all users of the affected Vikunja instance. Even an unsuccessful exploitation attempt (e.g., a failed restore) triggers the database wipe, making availability impact near-certain in any exploitation scenario (Vikunja Advisory, Github Advisory).

A public proof-of-concept exploit is available in the GitHub security advisory, including a Python script that generates a weaponized ZIP archive. Exploitation requires high privileges (administrator-level access to the vikunja restore CLI command) and network access, but no user interaction beyond the administrator running the restore command. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.042% (13th percentile), indicating a low but non-zero probability of exploitation in the near term (Github Advisory, Vikunja Advisory).

1. Reconnaissance: Identify a target Vikunja instance running a version prior to 2.0.0 (including code.vikunja.io/api ≤ 0.24.6). Confirm administrator access to the CLI or the ability to socially engineer an administrator into running a restore operation.
2. Craft malicious ZIP: Use the public PoC Python script to generate a ZIP archive (vikunja_critical_poc.zip) containing a mandatory VERSION file (e.g., v1.1.0) and a traversal-path entry such as ../../../pwned.txt with attacker-controlled content.
3. Deliver the archive: Provide the malicious ZIP to the target administrator, either directly or via social engineering (e.g., presenting it as a legitimate backup).
4. Trigger the restore: The administrator executes echo "Yes, I understand" | vikunja restore vikunja_critical_poc.zip on the server.
5. Observe impact: The application logs INFO: Wiped database., permanently destroying all application data. The traversal path entry is written to the host filesystem outside the intended directory. The process then panics with panic: runtime error: index out of range [-2], leaving the application non-functional.
6. Achieve objective: Depending on the traversal target, the attacker may have overwritten critical system files (e.g., cron jobs, SSH authorized_keys, web server configs) enabling persistent access or further lateral movement (Vikunja Advisory, Github Advisory).

• Logs: Vikunja application log entry INFO: Wiped database. followed immediately by a Go panic stack trace referencing pkg/modules/dump/restore.go:154 and panic: runtime error: index out of range [-2].
• File System: Unexpected files written outside the Vikunja data/extraction directory, particularly in parent directories (e.g., files in /, /home/, /etc/, or other sensitive paths); presence of a file named pwned.txt or similarly named attacker-controlled files in unexpected locations.
• File System: A ZIP archive named vikunja_critical_poc.zip or similar on the server or in administrator download history.
• Logs: Vikunja CLI invocation logs showing vikunja restore <archive> with an archive not originating from a trusted internal backup system.
• Database: Complete absence of application data following a restore operation, indicating the database wipe was triggered without successful restoration (Vikunja Advisory).

Upgrade Vikunja to version 2.0.0 or later, which pre-validates all table data JSON before wiping the database and sanitizes ZIP entry filenames using parseDbFileName to reject path traversal sequences. The fix commit (1b3d8dc) also adds bounds checking before slice index operations to prevent the runtime panic. Until patching is possible, restrict access to the vikunja restore CLI command to trusted administrators only, avoid restoring archives from untrusted sources, and consider temporarily disabling the restore feature if not actively required. Maintain secure offline backups separate from production systems to mitigate data loss risk (Fix Commit, Vikunja Changelog).

The advisory was published by Vikunja maintainer kolaente on February 25, 2026, and reviewed by the GitHub Advisory Database on February 26, 2026. The vulnerability was detected by Qualys scanners (detection ID 761789) and referenced by Red Hat's CVE tracking. No significant broader media coverage or notable researcher commentary beyond the official advisory has been identified at this time (Github Advisory, Vikunja Advisory).