Path Traversal Vulnerability in Kanboard Project Management Software

CVE-2025-55011

What is CVE-2025-55011?

A vulnerability exists in Kanboard, a project management tool that adheres to the Kanban method. The issue lies within the API's createTaskFile method, which lacks adequate validation for the task_id parameter, allowing unauthorized access to the file system. In the absence of checks for path traversal, an attacker could exploit this flaw to write files anywhere within the user's controlled environment. Although the potential impact is somewhat mitigated by the hashing of filenames and their lack of extensions, it poses a significant risk. Users should upgrade to version 1.2.47 or later to safeguard their systems.

References