Vikunja versions before 2.0.0 contain a critical path traversal vulnerability that allows authenticated attackers with administrative privileges to overwrite arbitrary files on the host system.

The restoreConfig function fails to sanitize file paths within ZIP archives, allowing path traversal (CWE-22) and arbitrary file overwrite. Additionally, the application is susceptible to an uncaught exception (CWE-248) that triggers a process crash after database deletion, requiring high privileges for exploitation.

The ability to overwrite arbitrary files on the host system presents a severe risk of system compromise, potentially leading to remote code execution or complete loss of service. Given the CVSS score of 7.2, this vulnerability is categorized as High, as it allows an administrative user to manipulate the underlying host environment and permanently destroy application data.

Immediate Action: Update the Vikunja instance to version 2.0.0 or later to include the necessary path validation and exception handling logic.

Proactive Monitoring: Review system logs for unusual file write activities in directories outside the intended data storage path and monitor the application process for unexpected termination events.

Compensating Controls: Restrict access to the configuration restore functionality to only the most trusted administrative accounts and ensure the application runs with the least privilege necessary to prevent unauthorized host file modifications.

Public Exploit Available: No.

This vulnerability represents a significant security oversight in the application's archive handling process. Administrators must prioritize upgrading to version 2.0.0 immediately to eliminate the risk of arbitrary file manipulation and service disruption. Organizations should also audit their administrative access controls to ensure the integrity of the platform is maintained.