CVE-2025-46825

Kanboard is project management software that focuses on the Kanban methodology. Versions 1.2.26 through 1.2.44 have a Stored Cross-Site Scripting (XSS) Vulnerability in the `name` parameter of the `http://localhost/?controller=ProjectCreationController&action=create` form. This vulnerability allows attackers to inject malicious scripts into web pages viewed by other users. Note that the default content security policy (CSP) blocks the JavaScript attack, though it can be exploited if an instance is badly configured and the software is vulnerable to CSS injection because of the unsafe-inline on the default CSP. Version 1.2.45 contains a fix for the issue.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/kanboard/kanboard/blame/v1.2.44/app/Template/project_view/importTasks.php#L11	Product
https://github.com/kanboard/kanboard/commit/6ebf22eeaae9f8b4abab72e3c18e45a2c4a2a808	Patch
https://github.com/kanboard/kanboard/commit/ac94004ea9fc455dcc5edc8a242d67d1ccd85564	Patch
https://github.com/kanboard/kanboard/security/advisories/GHSA-5wj3-c9v4-pj9v	Exploit Vendor Advisory
https://github.com/kanboard/kanboard/security/advisories/GHSA-5wj3-c9v4-pj9v	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:kanboard:kanboard:*:*:*:*:*:*:*:*

History

11 Jul 2025, 14:41

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-05-12 23:15

Updated : 2025-07-11 14:41

NVD link : CVE-2025-46825

Mitre link : CVE-2025-46825

CVE.ORG link : CVE-2025-46825

JSON object : View

Products Affected

kanboard

kanboard

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-46825", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 1.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-05-12T23:15:25.350", "references": [{"url": "https://github.com/kanboard/kanboard/blame/v1.2.44/app/Template/project_view/importTasks.php#L11", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/kanboard/kanboard/commit/6ebf22eeaae9f8b4abab72e3c18e45a2c4a2a808", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/kanboard/kanboard/commit/ac94004ea9fc455dcc5edc8a242d67d1ccd85564", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/kanboard/kanboard/security/advisories/GHSA-5wj3-c9v4-pj9v", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/kanboard/kanboard/security/advisories/GHSA-5wj3-c9v4-pj9v", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Kanboard is project management software that focuses on the Kanban methodology. Versions 1.2.26 through 1.2.44 have a Stored Cross-Site Scripting (XSS) Vulnerability in the `name` parameter of the `http://localhost/?controller=ProjectCreationController&action=create` form. This vulnerability allows attackers to inject malicious scripts into web pages viewed by other users. Note that the default content security policy (CSP) blocks the JavaScript attack, though it can be exploited if an instance is badly configured and the software is vulnerable to CSS injection because of the unsafe-inline on the default CSP. Version 1.2.45 contains a fix for the issue."}, {"lang": "es", "value": "Kanboard es un software de gesti\u00f3n de proyectos basado en la metodolog\u00eda Kanban. Las versiones 1.2.26 a 1.2.44 presentan una vulnerabilidad de Cross Site Scripting (XSS) almacenado en el par\u00e1metro `name` del formulario `http://localhost/?controller=ProjectCreationController&action=create`. Esta vulnerabilidad permite a los atacantes inyectar scripts maliciosos en p\u00e1ginas web visitadas por otros usuarios. Tenga en cuenta que la pol\u00edtica de seguridad de contenido (CSP) predeterminada bloquea el ataque de JavaScript, aunque puede explotarse si una instancia est\u00e1 mal configurada y el software es vulnerable a la inyecci\u00f3n de CSS debido a la funci\u00f3n unsafe-inline de la CSP predeterminada. La versi\u00f3n 1.2.45 contiene una soluci\u00f3n para este problema."}], "lastModified": "2025-07-11T14:41:27.417", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:kanboard:kanboard:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9FD04A5B-FCB2-4AF3-B5D8-56ACC4EC796D", "versionEndExcluding": "1.2.45", "versionStartIncluding": "1.2.26"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}