CVE-2025-46825
📋 TL;DR
Kanboard versions 1.2.26 through 1.2.44 have a stored cross-site scripting vulnerability in the project creation form's name parameter. Attackers can inject malicious scripts that execute when other users view affected pages. The default CSP blocks JavaScript execution but CSS injection may still be possible if CSP is misconfigured.
💻 Affected Systems
- Kanboard
📦 What is this software?
Kanboard by Kanboard
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, or deface the application interface through successful script execution.
Likely Case
Limited impact due to default CSP blocking JavaScript, but potential for CSS injection leading to UI manipulation or data exfiltration if CSP is weakened.
If Mitigated
Minimal impact with proper CSP configuration and input validation in place.
🎯 Exploit Status
Exploitation requires authenticated access to create projects. Attack complexity is medium due to CSP restrictions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.45
Vendor Advisory: https://github.com/kanboard/kanboard/security/advisories/GHSA-5wj3-c9v4-pj9v
Restart Required: No
Instructions:
1. Backup your Kanboard installation and database. 2. Download version 1.2.45 from the official repository. 3. Replace the affected files with the patched versions. 4. Clear application cache if applicable.
🔧 Temporary Workarounds
Enforce Strict CSP
allEnsure Content Security Policy is properly configured without 'unsafe-inline' directives
Review and update CSP headers in web server configuration
Input Validation Filter
allImplement additional input sanitization for the project name parameter
Add custom validation rules to sanitize HTML/script tags in project names
🧯 If You Can't Patch
- Restrict project creation permissions to trusted users only
- Implement web application firewall rules to block XSS payloads in project names
🔍 How to Verify
Check if Vulnerable:
Check Kanboard version in admin panel or by examining the application files. Versions 1.2.26-1.2.44 are vulnerable.Check Version:
Check Kanboard admin panel or examine app/version.php fileVerify Fix Applied:
Verify version is 1.2.45 or higher. Test project creation with XSS payloads to confirm sanitization.📡 Detection & Monitoring
Log Indicators:
- Unusual project creation activity
- Project names containing script tags or unusual characters
Network Indicators:
- HTTP requests with script payloads in project name parameter
SIEM Query:
web_requests WHERE url_path CONTAINS 'ProjectCreationController' AND parameters CONTAINS 'script' OR 'javascript'🔗 References
- https://github.com/kanboard/kanboard/blame/v1.2.44/app/Template/project_view/importTasks.php#L11
- https://github.com/kanboard/kanboard/commit/6ebf22eeaae9f8b4abab72e3c18e45a2c4a2a808
- https://github.com/kanboard/kanboard/commit/ac94004ea9fc455dcc5edc8a242d67d1ccd85564
- https://github.com/kanboard/kanboard/security/advisories/GHSA-5wj3-c9v4-pj9v
- https://github.com/kanboard/kanboard/security/advisories/GHSA-5wj3-c9v4-pj9v
