by Kastro
Paper/Archive/CVE-2025-55010

CVE-2025-55010

kanboard kanboard — Kanboard Authenticated Admin Remote Code Execution via Unsafe Deserialization of Events

EPSS 0.9%public exploitCVSS 9.1
critical.is priorityof 100
50
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 60.9.609 × 2012.2Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.47, an unsafe deserialization vulnerability in the ProjectEventActvityFormatter allows admin users the ability to instantiate arbitrary php objects by modifying the event["data"] field in the project_activities table. A malicious actor can update this field to use a php gadget to write a web shell into the /plugins folder, which then gives remote code execution on the host system. This issue has been patched in version 1.2.47.

Affected

ProductAffectedFixed inSource
kanboard< 1.2.47–CNA

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitgithub.com/kanboard/kanboard/security/advisories/GHSA-359x-c69j-q64rrefgithub.com/kanboard/kanboard/commit/7148ac092e5db6b33e0fc35e04bca328d96c1f6frefgithub.com/kanboard/kanboard/blob/b033c0e0f982f8158e240bce8ab54c29727f8efe/app/Formatter/ProjectActivityEventFormatter.php#L43-L57