CVE-2025-65778

Description

An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Uploaded attachments can be served with attacker-controlled Content-Type (text/html), allowing execution of attacker-supplied HTML/JS in the application's origin and enabling session/token theft and CSRF actions.

PUBLISHED Reserved 2025-11-18 | Published 2025-12-15 | Updated 2025-12-16 | Assigner mitre

References

github.com/wekan/wekan

wekan.fi/hall-of-fame/spacebleed/

github.com/...ommit/e9a727301d7b4f1689a703503df668c0f4f4cab8

github.com/wekan/wekan/blob/main/CHANGELOG.md

cve.org (CVE-2025-65778)

nvd.nist.gov (CVE-2025-65778)

Download JSON

Data based on CVE®. Copyright © 1999-2025, The MITRE Corporation. All rights reserved.