4.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-35601

CVE-2026-35601: Vikunja has an iCalendar Property Injection via CRLF in CalDAV Task Output

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CalDAV output generator builds iCalendar VTODO entries via raw string concatenation without applying RFC 5545 TEXT value escaping. User-controlled task titles containing CRLF characters break the iCalendar property boundary, allowing injection of arbitrary iCalendar properties such as ATTACH, VALARM, or ORGANIZER. This vulnerability is fixed in 2.3.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-35601

CVE-2026-35601:

4.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
code.vikunja.io/api	go	<= 2.2.2	2.3.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the improper construction of iCalendar files within the CalDAV feature of Vikunja. The root cause is the lack of output escaping for user-controlled data when generating the iCalendar .ics file. The primary function responsible is caldav.ParseTodos in pkg/caldav/caldav.go, which takes task data and builds the iCalendar string through raw concatenation. The vulnerability description explicitly points to this function. The provided patch confirms this by introducing a new escaping function, escapeICalText, and applying it to various fields within ParseTodos and its helper functions ParseAlarms and ParseRelations. Specifically, fields like task summary, description, UID, and categories were not escaped, allowing an authenticated user to inject CRLF characters and thus new iCalendar properties (e.g., ATTACH, VALARM). This could lead to phishing attacks, auto-download of malicious files, or social engineering. The analysis of the patch 7b29b1b6a5917906c5239008fb3f8e3bf49a9f9b clearly shows the vulnerable code being replaced with properly escaped versions, confirming the identified functions as the source of the vulnerability.

Vulnerable functions

caldav.ParseTodos

pkg/caldav/caldav.go

This function is responsible for generating iCalendar VTODO entries. It directly concatenated user-controlled task summaries (`t.Summary`) into the output string without proper escaping. This allowed for CRLF injection, enabling an attacker to add arbitrary iCalendar properties.

caldav.getCaldavColor

pkg/caldav/caldav.go

This function was modified to sanitize the color string by removing any non-hexadecimal characters. The previous implementation was vulnerable to CRLF injection if a crafted color string was provided, as it did not properly validate the input before concatenation.

caldav.ParseAlarms

pkg/caldav/caldav.go

This function, called by `ParseTodos`, constructs the VALARM component of the iCalendar entry. It used the alarm's description (`a.Description`) without escaping, making it another vector for iCalendar property injection.

caldav.ParseRelations

pkg/caldav/caldav.go

This function, also called by `ParseTodos`, handles task relations. It appended the raw UID of related tasks (`r.UID`) to the iCalendar string, which could be exploited if the UID contained malicious sequences.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.