CVE-2026-115507— Vikunja 2.2.0 before 2.7.1 HTML Injection via Notification Email Header
Quick assessment
Affected
go-vikunja vikunja
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Vikunja 2.2.0 至 2.7.1 之前的版本中， 文件中的 函数存在 HTML 注入漏洞。该函数将显示名称、任务标题和项目标题未经转义地直接插入到邮件锚点（ 标签）中。已认证用户可以构造特殊的标题或显示名称，从而闭合锚点标签，并在发送给项目成员的任务评论通知和任务提及通知邮件中注入网络钓鱼链接。
Possible ATT&CK Techniques 1 AI
T1566.002 · Spearphishing LinkAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| go-vikunja | vikunja | 2.2.0< 2.7.1 |
affected |
2.7.1 |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-115507
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Vikunja 2.2.0 before 2.7.1 HTML Injection via Notification Email Header
Source: CVE Program / CVE List V5
Vulnerability Description
Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/mail.go that interpolates display names and task and project titles raw into email anchors. Authenticated users can craft titles or display names that close the anchor and inject phishing links into task-comment and task-mention notification emails sent to project members.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| go-vikunja | vikunja | 2.2.0 ~ 2.7.1 | - |
|
II. Public POCs for CVE-2026-115507
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-115507
请登录查看更多情报信息。
Other References for CVE-2026-115507 (6)
-
https://github.com/go-vikunja/vikunja/blob/v2.7.0/pkg/notifications/mail.go#L132-L148 technical-description
IV. Related Vulnerabilities
Same product: vikunja
-
CVE-2026-111922
Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting L -
CVE-2026-111920
Vikunja 2.6.0 Broken Access Control via Inherited Project Pe -
CVE-2026-111921
Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link -
CVE-2026-111919
Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via W -
CVE-2026-111917
Vikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores
Same vendor: go-vikunja
-
CVE-2026-111922
Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting L -
CVE-2026-111920
Vikunja 2.6.0 Broken Access Control via Inherited Project Pe -
CVE-2026-111921
Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link -
CVE-2026-111919
Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via W -
CVE-2026-111918
Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Wr
Same weakness: CWE-79
-
CVE-2026-115350
Mistune before 3.3.0 Stored XSS via Include Directive HTML F -
CVE-2026-97635
Agent Zero Web UI XSS -
CVE-2026-115513
OpenCATS before 0.12.0 Stored XSS via MRU Navigation Panel -
CVE-2026-115246
subhajitkhan online-clinic-management-system patdocmsg.php c -
CVE-2024-58394
Retool 3.88.0 XSS via /api/imageProxy SVG Proxying
V. Comments for CVE-2026-115507
No comments yet