Code Injection Vulnerability in Wekan Open Source Kanban Board System
CVE-2025-65778
Currently unrated
What is CVE-2025-65778?
An issue was discovered in Wekan, an Open Source kanban board system, where uploaded attachments can be delivered with an attacker-controlled Content-Type (specifically text/html). This flaw allows malicious HTML/JavaScript code to be executed within the application's origin, potentially leading to session and token theft, as well as enabling various cross-site request forgery (CSRF) actions. The vulnerability was addressed in version 18.16, which mitigated the risk by ensuring proper handling of uploaded content.