SB2026072860 - Cross-site scripting in Wekan

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026072860

SB2026072860 - Cross-site scripting in Wekan

Published: July 28, 2026

Security Bulletin ID SB2026072860
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear


The vulnerability allows a remote user to execute arbitrary script in the exported HTML board view.

The vulnerability exists due to cross-site scripting in addBoardHTMLToZip() when processing entity-encoded card titles during HTML export and card click handling. A remote user can create a card with specially crafted entity-encoded markup in its title to execute arbitrary script in the exported HTML board view.

User interaction is required to open the exported HTML file and click the crafted card title. Script execution occurs in the downloaded export rather than the Wekan HTTP origin.


Remediation

Install update from vendor's website.

References