Security Advisory
CVE-2025-65778
CVE vulnerability detail — eXtreme Datacenter Security Operations
Description
An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Uploaded attachments can be served with attacker-controlled Content-Type (text/html), allowing execution of attacker-supplied HTML/JS in the applications origin and enabling session/token theft and CSRF actions.