CVE-2025-65112
CriticalSummary
PubNet is a self-hosted Dart & Flutter package service. Prior to version 1.1.3, the /api/storage/upload endpoint in PubNet allows unauthenticated users to upload packages as any user by providing arbitrary author-id values. This enables identity spoofing, privilege escalation, and supply chain attacks. This issue has been patched in version 1.1.3.
Risk Assessment
Risk of identity spoofing, privilege escalation, and supply chain attacks, potentially leading to package integrity compromise.
Recommendation
Immediately update PubNet to version 1.1.3 or later and enforce authentication for the upload endpoint.
Original NVD description (English source)
PubNet is a self-hosted Dart & Flutter package service. Prior to version 1.1.3, the /api/storage/upload endpoint in PubNet allows unauthenticated users to upload packages as any user by providing arbitrary author-id values. This enables identity spoofing, privilege escalation, and supply chain attacks. This issue has been patched in version 1.1.3.