Kanboard vulnerability allows attackers to upload malicious SQLite database, triggering file download

CVE-2024-51747

Summary

An authenticated admin within the Kanboard project management application can exploit a vulnerability that allows for unauthorized reading and deletion of files from the server. This occurs due to improper handling of file links stored in the SQLite database, specifically within the project_has_files table. When an attacker uploads a manipulated SQLite database file to Kanboard through a legitimate feature, they can create paths that lead to sensitive files being resolvable and downloadable. As a result, the attacker can trigger the download of files that are otherwise restricted by the application's permission model. To mitigate this risk, users are strongly advised to upgrade to version 1.2.42 or higher, as there are currently no workarounds available.

References