Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

ckan — Vulnerabilities & Security Advisories 15

All 15 CVE vulnerabilities found in ckan, with AI-generated Chinese analysis, references, and POCs.

This vulnerability aggregation page focuses on the open-source project CKAN, a data portal platform, and highlights security weaknesses classified under specific Common Weakness Enumeration tags. It collects disclosed security vulnerabilities affecting CKAN releases, covering advisories published from the project's early stable versions through its most recent maintenance releases. Readers can track the vendor's published advisories, analyze the evolution of a particular weakness class within the codebase, and examine the complete vulnerability history for specific CKAN versions. The page aggregates data from public sources, providing a structured view of known flaws without listing individual CVE identifiers directly in this introduction.

Vendor: ckan

CVE ID Title CVSS Severity Published
CVE-2026-42032 CKAN: Unauthenticated Authorization Bypass in `datastore_search_sql` CWE-863 - - 2026-05-13
CVE-2026-41255 CKAN: CSRF exemption primed by anonymous requests CWE-352 6.1 Medium 2026-05-13
CVE-2026-41132 CKAN: No certificate validation on STMP connection CWE-295 - - 2026-05-13
CVE-2026-42031 CKAN: Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql` CWE-89 - - 2026-05-13
CVE-2025-64100 CKAN Vulnerable to Session Cookie Fixation CWE-384 6.1 Medium 2025-10-29
CVE-2025-54384 CKAN stored XSS vulnerability in Markdown description fields CWE-79 6.3 Medium 2025-10-29
CVE-2025-24372 XSS vector in user uploaded images in group/org and user profiles in ckan CWE-79 7.3 High 2025-02-05
CVE-2024-43371 Potential access to sensitive URLs via CKAN extensions (SSRF) CWE-918 4.5 Medium 2024-08-21
CVE-2024-41675 CKAN has a Cross-site Scripting vector in the Datatables view plugin CWE-79 6.8 Medium 2024-08-21
CVE-2024-41674 CKAN may leak Solr credentials via error message in package_search action CWE-209 5.3 Medium 2024-08-21
CVE-2024-27097 Potential log injection in reset user endpoint in ckan CWE-532 4.3 Medium 2024-03-13
CVE-2023-50248 CKAN out of memory error when submitting the dataset form with a specially-crafted field CWE-130 4.5 Medium 2023-12-13
CVE-2023-32321 CKAN remote code execution and private information access via crafted resource ids CWE-20 9.8 Critical 2023-05-26
CVE-2023-22746 CKAN is vulnerable to session secret shared across instances using Docker images CWE-344 8.6 High 2023-02-03
CVE-2021-25967 CKAN - Stored Cross-Site Scripting (XSS) via SVG File Upload CWE-79 5.4 Medium 2021-12-01

All 15 known CVE vulnerabilities affecting ckan with full Chinese analysis, references, and POCs where available.