Threats tagged 'ghsa-29xm-vfjq-28wr'

Vikunja versions prior to 2.7.1 have a vulnerability where the PluginsDir and LogPath are not properly anchored to the service root path. This allows local attackers with write access to the startup working directory to plant malicious plugins that the server may load or to read sensitive log files such as audit.log. The vulnerability has a low severity rating with limited impact on confidentiality and integrity and no impact on availability.