ThinkDashboard Vulnerability

ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. It allows users to import backups of their bookmarks, which can be used to upload arbitrary files to the web application's /data directory. This vulnerability could lead to stored XSS attacks or malware distribution.

You're affected if you use ThinkDashboard version 0.6.7 or below. To check if your instance is vulnerable, run find / -name "ThinkDashboard*.exe" (Windows) or find / -name "thinkdashboard" (Linux/macOS). If you don't recognize the name, you're probably not affected.

1. Upgrade to ThinkDashboard version 0.6.8 or later from the official GitHub repository: https://github.com/MatiasDesuu/ThinkDashboard/releases/tag/v0.6.8.
2. Immediate mitigations:
3. Restrict network access to your ThinkDashboard instance (firewall it from the public internet).
4. Audit admin account activity for suspicious access patterns.
5. Monitor for unauthorized token creation.

• Patch
• Vendor Advisory