Code Injection Vulnerability in Wekan Kanban Software
CVE-2026-68900

7.6HIGH

Key Information:

Vendor

Wekan

Status
Wekan
Vendor
CVE Published:
19 August 2026

What is CVE-2026-68900?

Wekan, an open-source kanban tool, is susceptible to a code injection vulnerability that arises from improperly handled HTML content in exported files. Specifically, during the export process, the function addBoardHTMLToZip() allows for the inclusion of entity-encoded event-handler payloads in card titles, which are then executed when the exported HTML file is opened. This could enable a malicious participant to extract sensitive information from the exported data. The flaw was resolved in version 10.23, which now processes untrusted values safely by using textContent instead of innerHTML for content rendering.

Affected Version(s)

wekan >= 8.72, < 10.23

References

https://github.com/wekan/wekan/security/advisories/GHSA-8...
x_refsource_CONFIRM
https://github.com/wekan/wekan/commit/2d32e34621d340b00be...
x_refsource_MISC
https://github.com/wekan/wekan/releases/tag/v10.23
x_refsource_MISC

CVSS V3.1

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.