Threat Investigation
Request a demo

CVE-2025-65778

High

Description

An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Uploaded attachments can be served with attacker-controlled Content-Type (text/html), allowing execution of attacker-supplied HTML/JS in the application's origin and enabling session/token theft and CSRF actions.

SeverityHigh
CVSS8.1
Exploit probability—
ProductWekan
PublishedDec 15, 2025
First seenDec 15, 2025
Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Update
  • wekan_project wekan8.16 or later

Affected products

ProductAffected versionsFixed in
wekan_project wekanv < 8.168.16

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.