CVE-2026-68900

Executive Summary

CVE-2026-68900 is a stored Cross-Site Scripting (XSS) vulnerability affecting Wekan, an open-source kanban board application built on the Meteor framework, across versions 8.72 through 10.23. The flaw resides in the board export functionality where entity-encoded event-handler payloads stored in card titles are decoded and re-executed when a recipient opens the exported HTML file, enabling script execution in the context of the exported board data. Successful exploitation allows an attacker with board membership to exfiltrate all board data contained in the exported file, including content added after the attacker's membership was revoked, with a CVSS score of 7.6 (High).

Technical Analysis

The vulnerability exists in the export functionality of Wekan, specifically within the addBoardHTMLToZip() function defined in client/lib/exportHTML.js. The vulnerability class is stored Cross-Site Scripting (CWE-79) with a distinct attack mechanism that diverges from typical DOM-based XSS.

Root Cause Mechanism:

The vulnerable function reads card titles and bodies using the textContent property. While textContent is generally considered a safe way to retrieve text from DOM nodes (as it does not parse HTML entities), the critical flaw is that the retrieved values are subsequently interpolated into the HTML of the exported index.html file via the innerHTML assignment. This dual-step process creates a parse-reparse vulnerability:

1. Storage Phase: A malicious board member stores an entity-encoded payload (e.g., <img src=x onerror=...> encoded as <img src=x onerror=...>) in a card title. Because the payload is entity-encoded, the live board renders it as inert text — the browser does not interpret the encoded characters as executable HTML.

2. Export Phase: When the board is exported to HTML, the addBoardHTMLToZip() function retrieves the card title using textContent. Since textContent returns the decoded text representation, the entity-encoded payload is converted back to its original raw HTML form (e.g., < becomes <).

3. Re-Injection Phase: The now-decoded payload is interpolated into the exported index.html via the innerHTML setter. When a recipient opens the downloaded HTML file, the browser parses the payload as executable HTML, triggering the event-handler attribute and executing the embedded script.

Attack Surface:

• Precondition: Attacker requires board membership (any role sufficient to create or edit cards). This aligns with the CVSS vector's PR:L (Low privilege) requirement.
• Delivery Vector: The exported HTML file must be opened by a victim. This corresponds to the UI:R (User Interaction required) component of the CVSS vector.
• Post-exploitation Impact: The script executes in the context of the exported file and can read the complete board dataset contained within, including cards, comments, and attachments metadata present in that export. Notably, the NVD description states the script can transmit "content added after the attacker's membership was removed," implying the export captures board state at time of export, not at time of attacker's membership.

Patched Behavior (Version 10.23): The fix in version 10.23 takes a fundamentally safer approach: the modal (the UI element displaying card details in the export viewer) is built using DOM node creation methods, and untrusted values are assigned through the textContent property. This ensures that any content retrieved from card titles/bodies remains inert text and is never interpreted as executable HTML at any stage.

Exploitation Scenarios

Attack Chain:

Step 1 — Reconnaissance and Target Identification: An attacker identifies a Wekan instance running a vulnerable version (8.72 through 10.22). Public Wekan instances can be located via web search engines using default port signatures or HTTP response headers. The attacker obtains or creates a low-privilege account on the target board (or a board where they have membership). No special privileges are required beyond standard card creation/editing rights.

Step 2 — Triggering the Flaw: The attacker creates or edits a card on the target board and embeds a malicious event-handler payload in the card title using entity encoding. For example, the title might contain an encoded <img> or <svg> tag with an onerror or onload attribute containing JavaScript. The encoding ensures the live board displays the title as plain text — no execution occurs at this stage — evading both manual inspection and automated scanners that check the rendered DOM.

Step 3 — Payload Delivery and Execution: A legitimate board member (or administrator) uses the board export feature (accessible via the board menu) to download the board as an HTML ZIP archive. The addBoardHTMLToZip() function decodes the entity-encoded payload during the export process and embeds the raw HTML into index.html. Upon opening the exported file, the victim's browser parses the embedded payload, triggering the event handler and executing the script.

Step 4 — Post-Exploitation Impact: The script executes in the context of the exported HTML document, which contains the full board data. The payload can:

• Read all card titles, descriptions, comments, and metadata from the exported file's DOM.
• Transmit this data to an attacker-controlled server via HTTP requests (e.g., using fetch or Image() exfiltration techniques).
• Potentially steal session tokens or cookies if the exported file is hosted on a domain with access to the Wekan application, though this is dependent on how recipients access the export.

Exploitation Feasibility Notes: No public PoC or exploit code is available at the time of writing. The attack chain described above is inferred from the vulnerability class (stored XSS with entity-decoding) and the NVD description. The UI:R CVSS component indicates that user interaction (opening the export) is mandatory for successful exploitation, which slightly elevates the difficulty of mass exploitation but does not negate the severity given the sensitive nature of kanban board data in enterprise environments.

Impact Assessment

CVSS Analysis (Score: 7.6 — High):

Business Impact:

• Data Confidentiality Breach: Kanban boards frequently contain project roadmaps, customer information, internal processes, and personnel assignment data. The ability to exfiltrate board data including content added after the attacker's removal represents a significant confidentiality breach that can persist beyond the attacker's active membership period.
• Supply Chain Risk: If exported boards are shared with external partners or customers, the malicious payload is delivered to third-party environments, extending the blast radius beyond the Wekan instance.
• Insider Threat Amplification: A disgruntled or removed member can plant the payload while they still have access, and any subsequent board export will execute their script, effectively granting them continued data access after revocation.
• Compliance Impact: Organizations subject to data protection regulations (GDPR, HIPAA, etc.) may face reporting obligations if board data containing personal information is exfiltrated.

Blast Radius: The attack requires the victim to open a maliciously crafted export file, which limits the immediate blast radius to one user at a time. However, if the Wekan administrator uses board exports for backups or reporting, the payload could execute in administrative contexts, potentially exposing boards across multiple projects. The exported file may also be stored in shared network drives or ticketing systems, where multiple users could open it, amplifying the exposure.

Detection Guidance

The following detection rules are designed to identify either the preparation phase (entity-encoded payloads in card titles) or the execution phase (script execution from exported HTML files). Note that the server-side vulnerability means traditional WAF filtering of the export endpoint may not be sufficient, as the payload is already stored in the database and only decoded at export time.

Sigma Rule

title: Wekan Card Title with Encoded Event Handler Payload
id: 341f9a4c-6d3e-4c8b-9f1a-7e2b5d8c4a01
status: experimental
description: Detects creation or modification of Wekan cards containing entity-encoded HTML event handler attributes, potentially indicating preparation for CVE-2026-68900 exploitation
author: Valtersit Threat Intelligence
date: 2026/01/15
logsource:
    category: web_application
    product: wekan
    service: meteor
detection:
    selection_title:
        request.body|contains|all:
            - '<'
            - 'onerror'
    selection_body:
        request.body|contains|all:
            - '<'
            - 'onload'
    selection_fallback_1:
        request.body|contains|all:
            - '<img'
            - 'javascript:'
    selection_fallback_2:
        request.body|contains|all:
            - '<svg'
            - 'onerror'
    condition: selection_title or selection_body or selection_fallback_1 or selection_fallback_2
falsepositives:
    - Legitimate use of HTML entities in card titles (rare)
    - Developer documentation cards containing code examples
level: high
tags:
    - attack.t1203
    - cve.2026.68900
    - cwe.79

YARA Rule

rule Wekan_Encoded_Payload_Export_XSS
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects HTML export files from Wekan containing entity-encoded payloads that were decoded during export, indicating CVE-2026-68900 exploitation"
        date = "2026-01-15"
        cve = "CVE-2026-68900"
        severity = "high"
        reference = "NVD - CVE-2026-68900"
    
    strings:
        $html_open = /<div[^>]*class="[^"]*card[^"]*"/
        $encoded_img = /&lt;(img|svg)/
        $encoded_error = /&lt;[^&]*on(error|load)=/
        $decoded_handler = /<(img|svg)[^>]*(onerror|onload)\s*=\s*["']?javascript:/
        $innerHTML_pattern = /\.innerHTML\s*=\s*/
    
    condition:
        uint16(0) == 0x3C3F or uint16(0) == 0x3C21 // HTML file (starts with <? or <!)
        and (
            ($encoded_img and $encoded_error)
            or ($decoded_handler and $innerHTML_pattern)
            or ($html_open and $encoded_error)
        )
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"Wekan CVE-2026-68900 - Encoded Event Handler in Card Title Export"; flow:established,to_server; content:"POST"; http_method; content:"card"; http_uri; content:"<"; http_client_body; content:"onerror"; http_client_body; distance:0; within:200; sid:20268901; rev:1; metadata:attack_target Web_Application, cve CVE-2026-68900, tag xss; classtype:web-application-attack;)

alert http $HOME_NET any -> any any (msg:"Wekan CVE-2026-68900 - Exfiltration from Exported HTML Board"; flow:established,to_server; content:"GET"; http_method; content:".zip"; http_uri; content:"board"; http_uri; sid:20268902; rev:1; metadata:attack_target Web_Application, cve CVE-2026-68900; classtype:attempted-information-leak;)

alert http $HOME_NET any -> any any (msg:"Wekan CVE-2026-68900 - Data Exfiltration POST from Export"; flow:established,to_server; content:"POST"; http_method; content:"exfil"; http_uri; pcre:"/(exfil|collect|steal|callback)/i"; sid:20268903; rev:1; metadata:attack_target Web_Application, cve CVE-2026-68900; classtype:attempted-information-leak;)

Elastic Detection

// Elastic EQL query for detecting Wekan card creation with encoded payloads
sequence by user.name with maxspan=1m
  [any where process.name : "node" and event.action : "create" and
   network.protocol : "http" and
   url.path : "*api*card*" or url.path : "*cards*insert*"]
  [any where process.name : "node" and network.protocol : "http" and
   url.path : "*api*card*" and
   request.body : (
     "*<*onerror*",
     "*<*onload*",
     "*<img*",
     "*<svg*"
   )]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=iis OR sourcetype=apache
| where like(_raw, "%card%") 
| regex _raw="((%26lt%3B|<)([^>]*)(onerror|onload)=)" 
| stats count by src_ip, uri_path, http_method, user_agent
| sort -count
| rename src_ip as "Source IP", uri_path as "Requested Path", 
         http_method as "HTTP Method", user_agent as "User Agent"

// Additional query for exfiltration attempts from exported boards
index=proxy OR index=firewall
| where like(_raw, "%exfil%") OR like(_raw, "%collect%") OR like(_raw, "%callback%")
| stats count by src_ip, dest_ip, dest_port, url, user_agent
| where count > 3

Wazuh OSSEC Rule

<group name="wekan,">
  <rule id="100689" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.(insert|update).*card</field>
    <regex>.*(&lt;|%26lt%3B).*(onerror|onload).*</regex>
    <description>Wekan CVE-2026-68900: Entity-encoded event handler payload detected in card title creation/modification</description>
    <mitre>
      <id>T1203</id>
    </mitre>
    <group>wekan_xss,</group>
  </rule>

  <rule id="100690" level="14">
    <decoded_as>web-access</decoded_as>
    <regex>GET \S*\.(zip|html)\S*board\S*</regex>
    <description>Wekan board export downloaded - potential CVE-2026-68900 exploitation vector</description>
    <mitre>
      <id>T1203</id>
    </mitre>
    <group>wekan_export,</group>
  </rule>

  <rule id="100691" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">(exfil|collect|steal|callback)</field>
    <description>Potential data exfiltration from Wekan board export (CVE-2026-68900 related)</description>
    <mitre>
      <id>T1041</id>
    </mitre>
    <group>wekan_exfil,</group>
  </rule>
</group>

Detection Limitations:

• Server-side detection of the encoded payload is only possible if application-level logging captures the raw request bodies containing the entity-encoded content.
• The exfiltration traffic originates from the victim's browser opening the exported file, appearing as normal web traffic to external domains.
• Since Wekan uses Meteor's WebSocket-based DDP protocol for real-time updates, traditional HTTP access logs may not capture all card modification events.

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED

The CVE data indicates that no patch evidence has been confirmed from tracked sources. However, the NVD description explicitly states that "Version 10.23 builds the modal with DOM nodes and assigns untrusted values through textContent" and that "This issue is fixed in version 10.23." Organizations should verify the availability of Wekan version 10.23 from official distribution channels before deploying.

Immediate Mitigations (until patch verification):

1. Restrict Board Export Rights: Limit the ability to export boards to trusted administrators only. If the Wekan deployment allows per-board permissions configuration, disable export functionality for regular members.
2. Disable Board Exports Temporarily: If board export is not business-critical, disable the export feature entirely in the application configuration until the patch is confirmed deployed.
3. Review and Audit Card Titles: Manually inspect card titles for suspicious entity-encoded content (e.g., strings containing <, >, javascript:, onerror=, onload=). Use the Sigma rule above to automate this review via application logs.
4. User Education: Instruct all board users, especially administrators, to be cautious when opening downloaded board exports, particularly those received from untrusted sources or shared via public channels.
5. Network Monitoring: Deploy the Suricata rules provided to monitor for exfiltration attempts from users who open board exports.

Patch/Upgrade Steps:

1. Verify the availability of Wekan version 10.23 from the official Wekan repository or release channels.
2. Before upgrading, back up the Wekan database and application configuration.
3. Follow the official Wekan upgrade documentation. Wekan upgrades typically involve:
   • Stopping the running Meteor application
   • Updating the application code to the latest version
   • Running any required database migrations
   • Restarting the application
4. After upgrade, verify the application version via the About or version endpoint.
5. Test board export functionality with a dummy board containing HTML entity strings in card titles to confirm the fix is effective.

Long-Term Hardening:

1. Input Validation Strategy: Beyond the immediate fix, organizations should implement additional input sanitization on card titles/bodies at the application layer, rejecting or encoding HTML entity patterns that could be weaponized.
2. Content Security Policy (CSP): If the Wekan instance is served behind a reverse proxy (e.g., Nginx, Apache), implement a strict Content Security Policy that disallows inline JavaScript execution. Note: the exported HTML file is a static file opened locally by the victim, so CSP must be embedded in the exported file itself or applied via HTTP headers if the file is served from a web server.
3. Export File Sanitization: Consider deploying a downstream sanitization script that processes exported HTML files to strip any event-handler attributes before distribution.
4. Regular Security Audits: Include Wekan in the organization's periodic vulnerability scanning program. Subscribe to the Wekan security mailing list or monitor the CVE feed for the official patch confirmation and any additional advisories.
5. Access Control Review: Regularly review board membership and remove inactive or ex-member accounts promptly. The CVE description highlights the persistence of this attack vector — content added after an attacker's membership removal can still be exfiltrated, so membership hygiene alone is not sufficient.
6. Backup Integrity: Ensure board export files are treated as potentially untrusted data and are scanned by endpoint security products before opening.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-68900 — Official NVD record with description, CVSS vector, and CWE classification.
2. Wekan GitHub Repository: https://github.com/wekan/wekan — Official source repository. Monitor releases section for version 10.23 and the code changes to client/lib/exportHTML.js.
3. Wekan Official Website: https://wekan.github.io — Official project documentation and release announcements.
4. MITRE ATT&CK Technique T1203: https://attack.mitre.org/techniques/T1203/ — Reference for the associated adversary technique (Exploitation for Client Execution).
5. CWE-79 (Improper Neutralization of Input During Web Page Generation): https://cwe.mitre.org/data/definitions/79.html — Reference for the vulnerability class.

Known Threat Actor Campaigns or Exploit-in-the-Wild Evidence: No evidence of exploitation in the wild has been reported as of the report date. CISA has not added this CVE to the Known Exploited Vulnerabilities (KEV) catalog. The absence of public PoC or exploit code reduces the immediate urgency, but the vulnerability's moderate-to-high severity, ease of exploitation (Low complexity, Low privilege), and persistence beyond membership revocation make it a candidate for future weaponization by threat actors targeting project management and collaboration tools in enterprise environments.