CVE-2026-123510
LOW
NVD
CVSS Score
3.3
Severity
LOW
Published
Nov 08, 2026
Vendor
unknown
Description
Vikunja before 2.7.1 fails to re-anchor PluginsDir and LogPath to service.rootpath, allowing plugins to load from and logs to be written in the startup working directory. Local attackers able to write to that directory can plant plugins loaded into the server when plugins are enabled, or read misplaced logs including audit.log.