Critical · published August 12, 2025
🔥 An admin user can craft a simple modification that opens a backdoor to the entire system! Think of the ProjectEventActivityFormatter as a restaurant order system where the chef can secretly include a poisonous ingredient — just by tweaking what’s written down on the ticket, an attacker can introduce a harmful dish into the menu! Once exploited, a malicious actor can drop a web shell into the /plugins folder, allowing them to execute arbitrary commands on the host system. This could lead to a full takeover of your project management software, putting sensitive project data and user information at absolute risk!
Think of the ProjectEventActivityFormatter as a restaurant order system where the chef can secretly include a poisonous ingredient — just by tweaking what’s written down on the ticket, an attacker can introduce a harmful dish into the menu! This unsafe deserialization vulnerability in Kanboard allows admin users to instantiate arbitrary PHP objects by manipulating the event['data'] field in the project_activities table, resulting in remote code execution.
Once exploited, a malicious actor can drop a web shell into the /plugins folder, allowing them to execute arbitrary commands on the host system. This could lead to a full takeover of your project management software, putting sensitive project data and user information at absolute risk! Patch your Kanboard installation to version 1.2.47 immediately to close this critical vulnerability! Additionally, review your admin permissions and audit the event['data'] inputs to prevent similar exploits in the future. You've got this! With the update applied, your Kanboard will be back in safe hands! 🛡️