PT-2025-45378 · Unknown · Thinkdashboard

CVE-2025-64176 · Published 2025-11-06 · Updated 2025-11-21

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ThinkDashboard versions 0.6.7 and below

Description ThinkDashboard, a self-hosted bookmark dashboard built with Go and vanilla JavaScript, has an issue where an attacker can upload arbitrary files to the '/data' directory of the web application. This is possible through the backup import feature, bypassing client-side file-type verification by uploading a '.zip' file. Successful exploitation could lead to stored cross-site scripting (XSS) or malware distribution.

Recommendations Update to version 0.6.8 or later.

Exploit

Fix

XSS

Unrestricted File Upload

RCE

Weakness Enumeration

CWE-79

CWE-434

CWE-20

Related Identifiers

CVE-2025-64176

GHSA-JVMW-HG62-JR47

Affected Products

Thinkdashboard

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64176.json · Exploit
• https://github.com/MatiasDesuu/ThinkDashboard/commit/18d2f6aded0d6424cc4c8619731dd20563f4cfd8 · Patch
• https://github.com/MatiasDesuu/ThinkDashboard/security/advisories/GHSA-jvmw-hg62-jr47 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-64176 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64176 · Security Note
• https://twitter.com/VulmonFeeds/status/1986582915904405578 · Twitter Post
• https://t.me/cveNotify/143609 · Telegram Post
• https://t.me/CVEtracker/36719 · Telegram Post
• https://twitter.com/CVEnew/status/1986577137936310374 · Twitter Post