---
id: CVE-2026-91971
title: >-
  Vikunja before 2.6.0 fails to apply pixel decode limits to avatar and
  project-background upload endpoints, allowing authenticated users to upload
  crafted images that decode to excessive pixel counts
summary: >-
  Vikunja before 2.6.0 fails to apply pixel decode limits to avatar and
  project-background upload endpoints, allowing authenticated users to upload
  crafted images that decode to excessive pixel counts. Attackers can upload
  small images wit…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-400
vendor: go-vikunja
product: vikunja
affected:
  - vikunja < 2.6.0
published: '2026-09-15'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T19:17:16.073'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-91971'
references:
  - url: >-
      https://github.com/go-vikunja/vikunja/security/advisories/GHSA-4vh2-39rq-rq8j
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/vikunja-before-2.6.0-denial-of-service-via-avatar-upload
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/go-vikunja/vikunja/security/advisories/GHSA-4vh2-39rq-rq8j
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-21T18:48:29.629806Z'
epss: 0.00338
epssPercentile: 0.27382
ingestedAt: '2026-09-15T15:39:12.912Z'
---

## Overview

Vikunja before 2.6.0 fails to apply pixel decode limits to avatar and project-background upload endpoints, allowing authenticated users to upload crafted images that decode to excessive pixel counts. Attackers can upload small images with extreme aspect ratios that consume significant CPU and memory during processing, causing denial of service through repeated or concurrent uploads.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.