What’s Vulnerable › Vulnerabilities

CVE-2025-64176: ThinkDashboard: Arbitrary File Upload vulnerability in the Backup Import Feature

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-11-06 · updated 2026-06-17
• Weakness: CWE-20

Description

ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. In versions 0.6.7 and below, an attacker can upload any file they wish to the /data directory of the web application via the backup import feature. When importing a backup, an attacker can first choose a .zip file to bypass the client-side file-type verification. This could lead to stored XSS, or be used for other nefarious purposes such as malware distribution. This issue is fixed in version 0.6.8.

Affected products

• MatiasDesuu ThinkDashboard: before 0.6.8 — fixed in 0.6.8

How to fix

Upgrade to a fixed version: MatiasDesuu ThinkDashboard 0.6.8. Check the vendor advisory for mitigations.

References

• https://github.com/MatiasDesuu/ThinkDashboard/commit/18d2f6aded0d6424cc4c8619731dd20563f4cfd8
• https://github.com/MatiasDesuu/ThinkDashboard/security/advisories/GHSA-jvmw-hg62-jr47

Get alerted when CVE-2025-64176 or the next vulnerability affects your stack