Threats tagged 'ghsa-fgfv-xjh6-9vhx'

Vikunja versions prior to 2.7.1 have an insecure file permissions vulnerability that allows local users on a shared host to read dump archives created by the vikunja dump command. These archives are world-readable zip files located in the rootpath, potentially exposing sensitive information such as configuration files, password hashes, TOTP secrets, tokens, and stored files.