CVE-2024-51748: Kanboard RCE Vulnerability via SQLite Import

CVE-2024-51748 Overview

CVE-2024-51748 is a path traversal vulnerability [CWE-22] in Kanboard, an open-source project management application built around the Kanban methodology. An authenticated administrator can achieve arbitrary PHP code execution by abusing the SQLite database import feature combined with a separate file-write primitive on the server. The application_language setting stored in the settings table controls which translation file the application loads. An attacker who imports a crafted sqlite.db can point this value at an attacker-controlled translations.php file using directory traversal. Kanboard maintainers addressed the flaw in version 1.2.42.

Critical Impact
Authenticated administrators can execute arbitrary PHP code on the underlying server, resulting in full application and host compromise.

Affected Products

Kanboard versions prior to 1.2.42
Self-hosted Kanboard deployments exposing the admin settings interface
Environments where an adjacent service (FTP, file upload endpoint) permits writing translations.php

Discovery Timeline

2024-11-11 - CVE-2024-51748 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-51748

Vulnerability Analysis

Kanboard determines the user interface language by reading the application_language value from the settings table in its SQLite database. The application then loads a translations.php file from the path derived from this setting. Kanboard provides an administrative feature that imports an entire SQLite database file, which allows an attacker with admin credentials to rewrite arbitrary settings values.

The import routine does not validate or sanitize the application_language field against directory traversal sequences. When Kanboard concatenates this value into the translation file path, an attacker-supplied string containing ../ segments can escape the intended translations directory. The loader then executes any PHP present in the target file, converting a configuration write into full code execution under the web server user.

Root Cause

The root cause is missing input validation on values read from an untrusted SQLite database import. Kanboard trusts the application_language setting as a safe identifier rather than treating it as attacker-controllable input subject to path canonicalization.

Attack Vector

Exploitation requires two preconditions: authenticated administrator access to Kanboard, and the ability to place a file named translations.php somewhere on the server file system. The secondary write can originate from an anonymous FTP service, a co-hosted application with an upload feature, or any other primitive that lands attacker-controlled content on disk. The attacker then crafts a sqlite.db where application_language contains a traversal path leading to the planted translations.php. Importing the crafted database and triggering a page load causes Kanboard to include and execute the malicious PHP payload.

No verified proof-of-concept code has been published. Refer to the Kanboard GitHub Security Advisory for maintainer detail.

Detection Methods for CVE-2024-51748

Indicators of Compromise

Presence of unexpected translations.php files outside the Kanboard app/Locale/ directory tree
Recent use of the admin SQLite database import feature with an unfamiliar source file
application_language value in the settings table containing ../ or absolute path characters
PHP process spawning shell utilities (sh, bash, curl, wget) from the Kanboard web root

Detection Strategies

Audit Kanboard settings table entries and alert on any application_language value that is not a known ISO locale code
Monitor web server and application logs for POST requests to the database import endpoint followed by anomalous 200 responses
File integrity monitoring on the Kanboard installation directory and any adjacent writable paths for new translations.php files

Monitoring Recommendations

Enable authentication and administrative action logging in Kanboard and forward logs to a centralized SIEM
Alert on child processes of the PHP-FPM or Apache worker that are not part of normal Kanboard operation
Correlate FTP or upload service write events with subsequent Kanboard admin activity

How to Mitigate CVE-2024-51748

Immediate Actions Required

Upgrade Kanboard to version 1.2.42 or later on all instances
Rotate administrator credentials and review the admin user list for unauthorized accounts
Inspect the Kanboard installation and web-accessible directories for planted translations.php files and remove them
Review the application_language value in the settings table and reset it to a valid locale identifier

Patch Information

The Kanboard maintainers fixed CVE-2024-51748 in release 1.2.42. The vendor advisory is available at the Kanboard GitHub Security Advisory GHSA-jvff-x577-j95p. The maintainers state there are no known workarounds, so patching is required.

Workarounds

Restrict access to the Kanboard admin interface using network-level controls such as VPN or IP allow-listing until patching is complete
Disable or remove any co-located services (anonymous FTP, unauthenticated upload endpoints) that could deliver the required translations.php file
Enforce least privilege on the web server user so that the Kanboard process cannot read files outside its expected directory tree

bash

# Verify installed Kanboard version and upgrade
grep -R "const VERSION" /var/www/kanboard/app/constants.php
# Upgrade via official release archive
curl -L -o kanboard.zip https://github.com/kanboard/kanboard/archive/refs/tags/v1.2.42.zip