CVE-2025-64176
Last modified
CVE-2025-64176 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. In versions 0.6.7 and below, an attacker can upload any file they wish to the /data directory of the web application via the backup import feature. EPSS estimates a 0.23% chance of exploitation in the next 30 days.
Description
ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. In versions 0.6.7 and below, an attacker can upload any file they wish to the /data directory of the web application via the backup import feature. When importing a backup, an attacker can first choose a .zip file to bypass the client-side file-type verification. This could lead to stored XSS, or be used for other nefarious purposes such as malware distribution. This issue is fixed in version 0.6.8.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Matiasdesuu | Thinkdashboard | < 0.6.8 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-64176?
How severe is CVE-2025-64176?
How do I fix CVE-2025-64176?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-6417A vulnerability has been found in PHPGurukul Art Gallery Man…8.8
- CVE-2025-64170sudo-rs is a memory safe implementation of sudo and su writt…3.8
- CVE-2025-64171MARIN3R is a lightweight, CRD based envoy control plane for …8.7
- CVE-2025-64173Apollo Router Core is a configurable graph router written in…7.5
- CVE-2025-64174Magento-lts is a long-term support alternative to Magento Co…4.8
- CVE-2025-64175Gogs is an open source self-hosted Git service. In version 0…8.8
- CVE-2025-64177ThinkDashboard is a self-hosted bookmark dashboard built wit…6.1
- CVE-2025-64178Jellysweep is a cleanup tool for the Jellyfin media server. …8.9
- CVE-2025-64179lakeFS is an open-source tool that transforms object storage…5.3
- CVE-2025-6418A vulnerability was found in code-projects Simple Online Hot…9.8
- CVE-2025-64180Manager-io/Manager is accounting software. In Manager Deskto…10
- CVE-2025-64181OpenEXR provides the specification and reference implementat…7.5
Are you affected by CVE-2025-64176?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST