CVE-2025-65781: High severity wekan vulnerability
Published Dec 15, 2025
·Updated
An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Attachment upload API treats the Authorization bearer value as a userId and enters a non-terminating body-handling branch for any non-empty bearer token, enabling trivial application-layer DoS and latent identity-spoofing.
Affected Software
2 affected components
wekan<=18.15
Wekan project Wekan<8.16
Remediation
Event History
Dec 15, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·02:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-65781?
CVE-2025-65781 is classified as a medium severity vulnerability due to its potential for application-layer denial of service.
2
How do I fix CVE-2025-65781?
To resolve CVE-2025-65781, upgrade Wekan to version 18.16 or later.
3
What does CVE-2025-65781 affect?
CVE-2025-65781 affects Wekan versions up to and including 18.15.
4
What type of vulnerability is CVE-2025-65781?
CVE-2025-65781 is an application-layer denial of service vulnerability.
5
Can CVE-2025-65781 be exploited remotely?
Yes, CVE-2025-65781 can potentially be exploited remotely through the attachment upload API.