CVE-2025-65112 is a critical (CVSS 9.4) missing authentication flaw in PubNet, a self-hosted Dart and Flutter package service. Before version 1.1.3, the upload endpoint accepted packages from anyone and trusted a client-supplied author identifier. That enables identity spoofing and supply chain attacks. Upgrade to 1.1.3 or later.
What's affected
PubNet versions before 1.1.3 are affected. The record says the fix is in 1.1.3. The GitHub advisory lists the patched versions as 1.1.3 and 1.1.4, so move to the newest release you can.
The vulnerable endpoint is the package upload route. The advisory says it lacked an authentication check and accepted an author identifier from the client. It verified only that the named author existed, not that the requester was that author. As a result, an unauthenticated user could upload a package under any registered user's name, including an administrator.
Severity agrees across sources. The record gives CVSS 3.1 9.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) and the advisory labels it Critical with the same score. The advisory lists impacts such as identity spoofing, replacing legitimate packages with tampered versions, and injecting code that downstream consumers will install.
How to check if you're exposed
If you run PubNet, find your deployed version. For a container deployment, check the image tag:
docker ps --format "{{.Names}} {{.Image}}" | grep -i pubnet
Anything older than 1.1.3 is affected. For a source build, check the tag or commit you built from.
Then check the data. Review recent uploads in your package index. Look for package versions you did not publish, uploads at odd times, and packages attributed to administrators that the administrators do not recognize. Review your web server logs for requests to the upload path from addresses outside your team.
What to do now
- Upgrade PubNet to 1.1.3 or later, and preferably 1.1.4.
- Until then, block access to the upload endpoint from untrusted networks, or take the server off the internet.
- Audit all packages and versions uploaded since you deployed an affected version, and remove anything you cannot account for.
- Make projects that depend on your private packages verify versions against a known good list, such as a lockfile with hashes.
- Rotate credentials and tokens for administrator accounts, since actions may have been taken in their name.
Why it matters
There are two weaknesses here: CWE-306 (missing authentication for a critical function) and CWE-862 (missing authorization). The endpoint did not ask who the caller was, and it did not check whether the caller was allowed to act as the author they named. Trusting a field in the request for identity is a classic mistake.
Package registries sit at the center of the software supply chain. A private registry that accepts forged uploads can deliver code straight into developer machines and build systems that trust it. If you run one, treat it with the same care as production. The record does not say this flaw was exploited in the wild, and the KEV flag is false. The free Safeguard dependency scan can list the packages in a project and flag known CVEs, and the Gold directory keeps a page for each one.
Quick check
Which PubNet version should I run?
The advisory lists 1.1.3 and 1.1.4 as patched. Pick the newest release available.
How do I know if someone abused it?
Review uploaded packages and their author fields for anything unexpected, then check server logs for upload requests from unfamiliar sources.
Sources
Last reviewed: 18 October 2026.
