Cyber Resilience

CVE-2025-65112

CriticalPublic PoC

Published: 29 November 2025

Published
29 November 2025
Modified
03 December 2025
KEV Added
Patch
CVSS Score v3.1 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
EPSS Score 0.0008 24.0th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-65112 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Ricardoboss Pubnet. Its CVSS base score is 9.4 (Critical).

Operationally, ranked at the 24.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability details

PubNet is a self-hosted Dart & Flutter package service. Prior to version 1.1.3, the /api/storage/upload endpoint in PubNet allows unauthenticated users to upload packages as any user by providing arbitrary author-id values. This enables identity spoofing, privilege escalation, and supply…

more

chain attacks. This issue has been patched in version 1.1.3.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

ricardoboss
pubnet
≤ 1.1.4

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-306 CWE-862

Requiring identification and rationale for actions allowed without authentication ensures critical functions are not left unprotected by forcing review of authentication requirements.

addresses: CWE-306 CWE-862

Authorizing mobile device connections to organizational systems ensures authentication is performed for this critical access function.

addresses: CWE-862 CWE-306

Always invoking the reference monitor prevents missing authorization checks for protected resources.

addresses: CWE-306 CWE-862

Auditing sessions makes it possible to detect access to critical functions without required authentication.

addresses: CWE-306 CWE-862

The assessment process confirms authentication is present and effective for critical functions, preventing exploitation from missing authentication.

addresses: CWE-306 CWE-862

Certification assesses that critical functions have required authentication controls in place.

addresses: CWE-862 CWE-306

Requiring authorization servers ensures authorization is performed for protected functions.

addresses: CWE-306 CWE-862

Tailoring determines which functions require authentication and selects the appropriate baseline or compensating authentication controls.

References