CVE-2025-64176CWE-20CWE-434CWE-79

ThinkDashboard: Arbitrary File Upload vulnerability in the Backup Import Feature

Medium · published November 6, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
19.5
In the wild
Unconfirmed
What it is

ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. In versions 0.6.7 and below, an attacker can upload any file they wish to the /data directory of the web application via the backup import feature. When importing a backup, an attacker can first choose a .zip file to bypass the client-side file-type verification. This could lead to stored XSS, or be used for other nefarious purposes such as malware distribution. This issue is fixed in version 0.6.8.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00281 · 19.5th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-434 · Unrestricted Upload of File with Dangerous Type; CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-11-06T21:12Z
EPSS history
Timeline
  • 06 NOV 21:12Z
    ThinkDashboard: Arbitrary File Upload vulnerability in the Backup Import Feature
    cvelistv5