CVE-2025-65778
📋 TL;DR
This vulnerability allows attackers to upload malicious attachments that are served with HTML content types, enabling cross-site scripting (XSS) attacks within the Wekan application's origin. Attackers can steal user sessions, authentication tokens, and perform CSRF actions. All Wekan instances up to version 18.15 are affected.
💻 Affected Systems
- Wekan
📦 What is this software?
Wekan by Wekan Project
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover, data theft, and unauthorized administrative actions through stolen sessions and CSRF attacks.
Likely Case
Session hijacking leading to unauthorized access to boards, card data, and user information.
If Mitigated
Limited impact with proper content security policies and attachment validation in place.
🎯 Exploit Status
Exploitation requires ability to upload attachments (authenticated user), but the attack itself is straightforward once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 18.16
Vendor Advisory: https://wekan.fi/hall-of-fame/spacebleed/
Restart Required: Yes
Instructions:
1. Backup your Wekan data and configuration. 2. Update to Wekan version 18.16 or later. 3. Restart the Wekan service. 4. Verify the fix by checking the version and testing attachment uploads.
🔧 Temporary Workarounds
Disable attachment uploads
allTemporarily disable file upload functionality to prevent exploitation
Modify Wekan configuration to set ALLOW_FILE_UPLOAD=false
Implement strict Content-Type validation
allAdd middleware to validate and sanitize Content-Type headers for uploaded files
Add custom validation in Wekan's attachment handling code
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers to limit script execution
- Monitor and audit all file uploads for suspicious Content-Type values
🔍 How to Verify
Check if Vulnerable:
Check if Wekan version is 18.15 or earlier. Review if uploaded files can be served with text/html Content-Type.Check Version:
Check Wekan admin panel or run: docker exec wekan-app node -e "console.log(require('/app/programs/server/npm/node_modules/meteor/wekan/package.json').version)"Verify Fix Applied:
After updating to 18.16+, test uploading a file and verify it's served with correct Content-Type (not text/html).📡 Detection & Monitoring
Log Indicators:
- File uploads with suspicious filenames or extensions
- Requests for attachments with Content-Type: text/html
Network Indicators:
- Unusual spikes in attachment downloads
- Requests to attachment endpoints with suspicious referrers
SIEM Query:
source="wekan" AND (attachment_upload OR file_upload) AND (content_type="text/html" OR filename="*.html")