CVE-2025-65112
Critical · CVSS 9.4- CVSS
- 9.4
- nvd
- EPSS
- —
- KEV
- No
- Class
- oss containerizable
- CWE-306, CWE-862
Description
PubNet is a self-hosted Dart & Flutter package service. Prior to version 1.1.3, the /api/storage/upload endpoint in PubNet allows unauthenticated users to upload packages as any user by providing arbitrary author-id values. This enables identity spoofing, privilege escalation, and supply chain attacks. This issue has been patched in version 1.1.3.
References
Status: profiled · ingested 2026-10-08T00:00:43.000Z