PT-2025-51220 · Wekan · Wekan

Siam Thanat Hack + 1 · CVE-2025-65781 · Published 2025-12-15 · Updated 2025-12-15

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions Wekan versions prior to 18.16

Description An issue exists in the Attachment upload API of Wekan, an open-source kanban board system. The API incorrectly processes the Authorization bearer token as a userId, leading to a non-terminating process when a non-empty token is provided. This can cause a denial-of-service condition and potentially allow for identity spoofing. The API endpoint affected is the attachment upload API. The vulnerable parameter is the Authorization bearer token.

Recommendations Update to version 18.16 or later.

Exploit

Fix

DoS

Resource Exhaustion

Improper Authentication

Weakness Enumeration

CWE-400

CWE-287

Related Identifiers

CVE-2025-65781

Affected Products

Wekan

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65781.json · Exploit
• https://github.com/wekan/wekan/commit/ccd90343394f433b287733ad0a33c08e0a71f53c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-65781 · Security Note
• https://wekan.fi/hall-of-fame/spacebleed · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-65781 · Vendor Advisory
• https://github.com/wekan/wekan · Note
• https://github.com/wekan/wekan/blob/main/CHANGELOG.md#v816-2025-11-02-wekan--release · Note
• https://t.me/CVEtracker/39829 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2000589634628174197 · Twitter Post
• https://twitter.com/CVEnew/status/2000611249789481239 · Twitter Post