CVE-2025-64176

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. In versions 0.6.7 and below, an attacker can upload any file they wish to the /data directory of the web application via the backup import feature. When importing a backup, an attacker can first choose a .zip file to bypass the client-side file-type verification. This could lead to stored XSS, or be used for other nefarious purposes such as malware distribution. This issue is fixed in version 0.6.8.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-20CWE-79CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Nov 6, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-641776.1ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. In versions 0.6.7 and below, there is a stored CrosCVE-2025-641788.9Jellysweep is a cleanup tool for the Jellyfin media server. In versions 0.12.1 and below, /api/images/cache, used to download media posters CVE-2025-641795.3lakeFS is an open-source tool that transforms object storage into a Git-like repositories. In versions 1.69.0 and below, missing authenticatCVE-2025-64189.8A vulnerability was found in code-projects Simple Online Hotel Reservation System 1.0 and classified as critical. Affected by this issue is CVE-2025-6418010.0Manager-io/Manager is accounting software. In Manager Desktop and Server versions 25.11.1.3085 and below, a critical vulnerability permits uCVE-2025-641817.5OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture indusCVE-2025-641827.8OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture indusCVE-2025-641837.5OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture indusCVE-2025-641848.8Dosage is a comic strip downloader and archiver. When downloading comic images in versions 3.1 and below, Dosage constructs target file nameCVE-2025-641856.9Open OnDemand is an open-source HPC portal. Prior to versions 4.0.8 and 3.1.16, Open OnDemand packages create world writable locations in thCVE-2025-641866.5Evervault is a payment security solution. A vulnerability was identified in the `evervault-go` SDK’s attestation verification logic in versiCVE-2025-641874.4OctoPrint provides a web interface for controlling consumer 3D printers. Versions 1.11.3 and below are affected by a vulnerability that allo