PT-2025-51217 · Wekan · Wekan

Siam Thanat Hack + 1 · Published 2025-12-15 · Updated 2025-12-18 · CVE-2025-65778

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Wekan versions prior to 18.16

Description An issue exists in Wekan, an open-source kanban board system, where uploaded attachments can be served with a Content-Type controlled by an attacker (specifically, text/html). This allows for the execution of attacker-supplied HTML and JavaScript code within the application’s origin. Successful exploitation could lead to session or token theft and Cross-Site Request Forgery (CSRF) actions.

Recommendations Update to version 18.16 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-65778

Affected Products

Wekan

References · 9

• https://github.com/wekan/wekan/commit/e9a727301d7b4f1689a703503df668c0f4f4cab8 · Patch
• https://wekan.fi/hall-of-fame/spacebleed · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-65778 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65778 · Security Note
• https://github.com/wekan/wekan/blob/main/CHANGELOG.md#v816-2025-11-02-wekan--release · Note
• https://github.com/wekan/wekan · Note
• https://t.me/cveNotify/146147 · Telegram Post
• https://twitter.com/CVEnew/status/2000611247059087503 · Twitter Post
• https://t.me/CVEtracker/39826 · Telegram Post