Vulnerability · Published Aug 12, 2025 · Assigned by GitHub_M

CVE-2025-55010Kanboard Authenticated Admin Remote Code Execution via Unsafe Deserialization of Events

Critical 9.1

In plain English

A critical-severity unsafe deserialization in kanboard from kanboard. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)1.0%top 36.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.47, an unsafe deserialization vulnerability in the ProjectEventActvityFormatter allows admin users the ability to instantiate arbitrary php objects by modifying the event["data"] field in the project_activities table. A malicious actor can update this field to use a php gadget to write a web shell into the /plugins folder, which then gives remote code execution on the host system. This issue has been patched in version 1.2.47.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:14	kanboard	1.2.47+ds-1	DEBIAN-CVE-2025-55010

Affected products (as reported)

Vendor	Product	Versions
kanboard	kanboard	< 1.2.47

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References

https://github.com/kanboard/kanboard/security/advisories/GHSA-359x-c69j-q64r x_refsource_CONFIRM
https://github.com/kanboard/kanboard/commit/7148ac092e5db6b33e0fc35e04bca328d96c1f6f x_refsource_MISC
https://github.com/kanboard/kanboard/blob/b033c0e0f982f8158e240bce8ab54c29727f8efe/app/Formatter/ProjectActivityEventFormatter.php#L43-L57 x_refsource_MISC