CVE-2026-68900

Name of the Vulnerable Software and Affected Versions Wekan versions 8.72 through 10.22

Description The addBoardHTMLToZip() function in client/lib/exportHTML.js reads card titles and bodies using textContent, which decodes entity-encoded markup. These values, titleText and allText, are then interpolated into content.innerHTML within the exported index.html file. A board member can store an entity-encoded event-handler payload in a card title that remains inactive on the live board but is executed when a recipient opens the downloaded HTML export. This allows the script to read and transmit all board data contained in the export, including information added after the attacker's membership was revoked.

Recommendations Update to version 10.23.