CVE-2025-65922: Planka XSS Vulnerability (Disputed)

CVE-2025-65922 Overview

CVE-2025-65922 is a User Interface Confusion vulnerability affecting PLANKA 2.0.0, a popular open-source Kanban board application. The vulnerability stems from missing X-Frame-Options and Content-Security-Policy (CSP) frame-ancestors headers, which allows the application to be embedded within potentially malicious iframes.

While this vulnerability does not enable direct modification of projects or tasks within PLANKA, it exposes users to phishing attacks through UI Redressing techniques. Attackers can frame the legitimate PLANKA application on a malicious site to establish false trust, potentially tricking users into entering sensitive information or credentials into overlaid fake forms.

Critical Impact
Users may be deceived into providing credentials or sensitive information to attackers through UI redressing attacks that frame the legitimate PLANKA application to establish false trust.

Note: This vulnerability is disputed by the supplier. The vendor argues that PLANKA uses SameSite=Strict cookies, preventing authentication in cross-origin contexts. They contend that no session can be established, no credential interception or unauthorized actions are possible, and that browser Same-Origin Policy prevents the parent page from accessing iframe content.

Affected Products

PLANKA 2.0.0

Discovery Timeline

2026-01-05 - CVE CVE-2025-65922 published to NVD
2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-65922

Vulnerability Analysis

This vulnerability is classified under CWE-1021 (Improper Restriction of Rendered UI Layers or Frames), commonly known as clickjacking or UI redressing. The core issue lies in the absence of HTTP security headers that would prevent the PLANKA application from being embedded in frames controlled by third-party websites.

Without the X-Frame-Options header or CSP frame-ancestors directive, browsers have no instruction to prevent rendering PLANKA within an iframe on an attacker-controlled domain. This creates an opportunity for attackers to overlay deceptive UI elements on top of or around the legitimate application interface.

The attack requires user interaction and relies on social engineering to be successful. The attacker must convince the user to visit the malicious site and interact with what appears to be the legitimate PLANKA interface.

Root Cause

The root cause is the absence of protective HTTP response headers in PLANKA 2.0.0:

Missing X-Frame-Options Header - This header, when set to DENY or SAMEORIGIN, instructs browsers to refuse rendering the page in frames from other origins.
Missing CSP frame-ancestors Directive - The Content-Security-Policy frame-ancestors directive provides modern, more granular control over which origins can embed the page.

Without these headers, the web server responds to requests without frame embedding restrictions, allowing any website to embed PLANKA in an iframe.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker would typically:

Create a malicious website with an iframe loading the legitimate PLANKA application
Overlay transparent or semi-transparent elements over the iframe to intercept user input
Position fake form fields over the legitimate login page to harvest credentials
Distribute links to the malicious site via phishing emails or other social engineering methods

The supplier disputes the severity of this attack vector, noting that SameSite=Strict cookies prevent session establishment in cross-origin iframes. They argue that an attacker could achieve the same effect with a fully fake login page, and embedding the legitimate page adds no additional risk since browsers do not display URL, certificate, or padlock indicators in cross-origin iframes.

For detailed technical analysis, refer to the CVE-2025-65922 document on GitHub.

Detection Methods for CVE-2025-65922

Indicators of Compromise

HTTP response headers from PLANKA missing X-Frame-Options or CSP frame-ancestors directives
Users reporting access to PLANKA through unexpected or suspicious URLs
Reports of phishing attempts impersonating PLANKA login pages

Detection Strategies

Scan PLANKA deployment HTTP responses for missing security headers using automated security scanners
Monitor referrer logs for unexpected third-party domains embedding PLANKA
Implement browser extension policies that warn users about framed content

Monitoring Recommendations

Regularly audit HTTP security headers on PLANKA deployments
Monitor for phishing campaigns targeting PLANKA users
Review web application firewall logs for unusual iframe embedding patterns

How to Mitigate CVE-2025-65922

Immediate Actions Required

Configure web server or reverse proxy to add X-Frame-Options: DENY or X-Frame-Options: SAMEORIGIN header
Implement Content-Security-Policy header with frame-ancestors 'self' directive
Educate users about verifying the URL bar before entering credentials

Patch Information

As of the last modification date (2026-01-08), no official patch has been released addressing this issue. The vulnerability is disputed by the supplier who argues that existing security controls (SameSite=Strict cookies and browser Same-Origin Policy) adequately mitigate the risk. Organizations should implement header-based mitigations at the web server or reverse proxy level.

For the latest information, monitor the PLANKA GitHub repository for updates.

Workarounds

Deploy PLANKA behind a reverse proxy configured to add frame-busting headers
Use web application firewalls (WAF) to inject security headers into responses
Restrict network access to PLANKA to trusted internal networks where practical
Implement user training to recognize phishing attempts and verify URLs

bash

# Nginx configuration example to add security headers
server {
    # Add X-Frame-Options header
    add_header X-Frame-Options "SAMEORIGIN" always;
    
    # Add Content-Security-Policy frame-ancestors directive
    add_header Content-Security-Policy "frame-ancestors 'self';" always;
    
    # Additional recommended headers
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
}