Cross-site scripting in Wekan - #VU139857
Published: July 28, 2026
Vulnerability identifier: #VU139857
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear
CVE-ID: N/A
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: wekan.github.io
Affected software:
Wekan
Wekan
Detailed vulnerability description
The vulnerability allows a remote user to execute arbitrary script in the exported HTML board view.
The vulnerability exists due to cross-site scripting in addBoardHTMLToZip() when processing entity-encoded card titles during HTML export and card click handling. A remote user can create a card with specially crafted entity-encoded markup in its title to execute arbitrary script in the exported HTML board view.
User interaction is required to open the exported HTML file and click the crafted card title. Script execution occurs in the downloaded export rather than the Wekan HTTP origin.
Remediation
Install security update from vendor's website.