CVE-2025-65922: Planka XSS Vulnerability (Disputed)

CVE-2025-65922 Overview

CVE-2025-65922 is a User Interface Confusion vulnerability affecting PLANKA 2.0.0, a popular open-source Kanban board application. The vulnerability stems from missing X-Frame-Options and Content-Security-Policy (CSP) frame-ancestors headers, which allows the application to be embedded within potentially malicious iframes.

While this vulnerability does not enable direct modification of projects or tasks within PLANKA, it exposes users to phishing attacks through UI Redressing techniques. Attackers can frame the legitimate PLANKA application on a malicious site to establish false trust, potentially tricking users into entering sensitive information or credentials into overlaid fake forms.

Critical Impact

Users may be deceived into providing credentials or sensitive information to attackers through UI redressing attacks that frame the legitimate PLANKA application to establish false trust.

Note: This vulnerability is disputed by the supplier. The vendor argues that PLANKA uses SameSite=Strict cookies, preventing authentication in cross-origin contexts. They contend that no session can be established, no credential interception or unauthorized actions are possible, and that browser Same-Origin Policy prevents the parent page from accessing iframe content.

Affected Products

• PLANKA 2.0.0

Discovery Timeline

• 2026-01-05 - CVE CVE-2025-65922 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-65922

Vulnerability Analysis

This vulnerability is classified under CWE-1021 (Improper Restriction of Rendered UI Layers or Frames), commonly known as clickjacking or UI redressing. The core issue lies in the absence of HTTP security headers that would prevent the PLANKA application from being embedded in frames controlled by third-party websites.

Without the X-Frame-Options header or CSP frame-ancestors directive, browsers have no instruction to prevent rendering PLANKA within an iframe on an attacker-controlled domain. This creates an opportunity for attackers to overlay deceptive UI elements on top of or around the legitimate application interface.

The attack requires user interaction and relies on social engineering to be successful. The attacker must convince the user to visit the malicious site and interact with what appears to be the legitimate PLANKA interface.

Root Cause

The root cause is the absence of protective HTTP response headers in PLANKA 2.0.0:

1. Missing X-Frame-Options Header - This header, when set to DENY or SAMEORIGIN, instructs browsers to refuse rendering the page in frames from other origins.

2. Missing CSP frame-ancestors Directive - The Content-Security-Policy frame-ancestors directive provides modern, more granular control over which origins can embed the page.

Without these headers, the web server responds to requests without frame embedding restrictions, allowing any website to embed PLANKA in an iframe.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker would typically:

1. Create a malicious website with an iframe loading the legitimate PLANKA application
2. Overlay transparent or semi-transparent elements over the iframe to intercept user input
3. Position fake form fields over the legitimate login page to harvest credentials
4. Distribute links to the malicious site via phishing emails or other social engineering methods

The supplier disputes the severity of this attack vector, noting that SameSite=Strict cookies prevent session establishment in cross-origin iframes. They argue that an attacker could achieve the same effect with a fully fake login page, and embedding the legitimate page adds no additional risk since browsers do not display URL, certificate, or padlock indicators in cross-origin iframes.

For detailed technical analysis, refer to the CVE-2025-65922 document on GitHub.

Detection Methods for CVE-2025-65922

Indicators of Compromise

• HTTP response headers from PLANKA missing X-Frame-Options or CSP frame-ancestors directives
• Users reporting access to PLANKA through unexpected or suspicious URLs
• Reports of phishing attempts impersonating PLANKA login pages

Detection Strategies

• Scan PLANKA deployment HTTP responses for missing security headers using automated security scanners
• Monitor referrer logs for unexpected third-party domains embedding PLANKA
• Implement browser extension policies that warn users about framed content

Monitoring Recommendations

• Regularly audit HTTP security headers on PLANKA deployments
• Monitor for phishing campaigns targeting PLANKA users
• Review web application firewall logs for unusual iframe embedding patterns

How to Mitigate CVE-2025-65922

Immediate Actions Required

• Configure web server or reverse proxy to add X-Frame-Options: DENY or X-Frame-Options: SAMEORIGIN header
• Implement Content-Security-Policy header with frame-ancestors 'self' directive
• Educate users about verifying the URL bar before entering credentials

Patch Information

As of the last modification date (2026-01-08), no official patch has been released addressing this issue. The vulnerability is disputed by the supplier who argues that existing security controls (SameSite=Strict cookies and browser Same-Origin Policy) adequately mitigate the risk. Organizations should implement header-based mitigations at the web server or reverse proxy level.

For the latest information, monitor the PLANKA GitHub repository for updates.

Workarounds

• Deploy PLANKA behind a reverse proxy configured to add frame-busting headers
• Use web application firewalls (WAF) to inject security headers into responses
• Restrict network access to PLANKA to trusted internal networks where practical
• Implement user training to recognize phishing attempts and verify URLs

# Nginx configuration example to add security headers
server {
    # Add X-Frame-Options header
    add_header X-Frame-Options "SAMEORIGIN" always;
    
    # Add Content-Security-Policy frame-ancestors directive
    add_header Content-Security-Policy "frame-ancestors 'self';" always;
    
    # Additional recommended headers
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
}