Threats tagged 'ghsa-v3ff-w4v5-fqw6'

Vikunja versions prior to 2.7.1 have a client-side request forgery vulnerability that allows users with write access to embed image elements in rich text fields. This can cause viewers' clients to make unintended requests to loopback or LAN addresses, potentially exposing local services to unauthorized access or tracking when content is viewed.