CVE-2025-55010

Name of the Vulnerable Software and Affected Versions: Kanboard versions prior to 1.2.47

Description: Kanboard is project management software based on the Kanban methodology. A deserialization issue in ProjectEventActvityFormatter allows administrators to instantiate arbitrary PHP objects by modifying the event["data"] field in the project activities table. An attacker can update this field to use a PHP gadget to write a web shell into the /plugins folder, resulting in remote code execution on the host system.

Recommendations: Update Kanboard to version 1.2.47 or later.