Cross-site scripting in Wekan - CVE-2026-68900
Published: July 28, 2026 / Updated: August 21, 2026
Vulnerability identifier: #VU139857
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-68900
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary script in the exported HTML board view.
The vulnerability exists due to cross-site scripting in addBoardHTMLToZip() when processing entity-encoded card titles during HTML export and card click handling. A remote user can create a card with specially crafted entity-encoded markup in its title to execute arbitrary script in the exported HTML board view.
User interaction is required to open the exported HTML file and click the crafted card title. Script execution occurs in the downloaded export rather than the Wekan HTTP origin.
Affected software
Wekan
How to mitigate CVE-2026-68900
Install security update from vendor's website.
Wekan - update to 10.23